X-MAG AntiDetect features

Android AntiDetect control panel: balance, subscription, device protection and secure app delivery.

We operate at the level of anti-fraud systems themselves

Anti-fraud systems have long checked not «what is written» in device parameters, but where the data comes from: system calls, process memory, sensors, browser APIs, Google identifiers, and the match between geolocation and IP.

X-MAG goes deeper. We intercept data before any app or browser reads it and deliver a consistent picture — on the native, system and network levels at once. Even where typical antidetects that rely on LSPosed and in-app Zygisk hooks usually fail.

Unlimited isolated profiles

Highlight

Create an unlimited number of profiles — limited only by your phone's memory. Every profile is fully isolated: its own unique set of device parameters, its own browser and its own connection. Profiles never overlap.

Switching between profiles takes one tap: every spoofed parameter instantly becomes the one bound to the selected profile. Anti-fraud sees a completely different device.

Profile spoofing works everywhere

in the built-in isolated browser — with its own session per profile
in an external browser (Chrome, Cromite or any other) — all profile spoofing applies there too
in any installed app — the profile's parameters apply to it as well
in profile settings — link apps and choose protection tiers for hard anti-fraud

Full RASP & banking apps — no LSPosed, no in-app Zygisk hooks

Exclusive

X-MAG runs cleanly with Full RASP apps — where most antidetects fail. Examples: Revolut, HSBC, FanDuel, WorldRemit, bet365 and more.

This is powered by our exclusive device-parameter spoofing methods. For such apps we do not use LSPosed and do not place Zygisk hooks inside the app process — unlike typical antidetects.

Profile settings include a tool to link such apps — pick a protection tier and run them without extra hassle
Protection tiers: normal / soft / banking — matched to the app
LSPosed is required only for our built-in browser — not for banking apps and not for third-party apps
GSF ID is spoofed in RASP apps too — including after Google Play services updates
Install metadata (date and source) is spoofed at the system level, without hooks inside the app process

Full control over the Wi‑Fi environment

New

A full Wi‑Fi environment editor in profile settings: not just «spoof the SSID», but build a realistic network picture for the profile's geo.

Generate neighbouring APs from profile geo (city, country, network density)
Add, edit and delete APs: SSID, BSSID, channel, band, security, router (vendor)
The connected network stays in sync with profile Wi‑Fi; neighbours can stay or be cleared entirely
Scan modes FAKE and REAL — matched to the profile task

Automation API (XHTTP)

New

A full Automation API (XHTTP) to control X-MAG from a PC. Not a limited command set: the complete app functionality is available.

Profiles, spoofing, proxy, network and built-in browsers — all through the API
Runs locally on the device and is reached from a PC; every request uses a token bound to your subscription and this device
The subscription cannot be shared to another device through the API
Available on 30-day and longer plans, and on VIP; not available on the 7-day plan
In the app: Automation API (PC)

GSF ID and Fingerprint.com in apps

New

GSF ID spoofing is restored after the Google Play services update. Fingerprint.com is now handled not only in the browser, but in apps too.

After a GMS update, apps like Fingerprint.com and Device ID no longer show GSF ID as Unknown
Works in regular apps and in RASP-protected apps
Android ID, Advertising ID and GSF ID are spoofed consistently

App install metadata

New

In the profile you can set app install metadata: the source (Play Store and others) and install / update dates.

firstInstallTime, lastUpdateTime and the install source are set in profile settings
For heavily protected apps, spoofing is applied at the system level, without hooks inside the app process
Applies to apps linked to the profile

Built-in isolated browser

Each profile has its own isolated Chromium-based browser with individual, unique fingerprints. Browsers of different profiles never mix.

Cookies, cache, history, logins and localStorage are stored separately for each profile
Canvas, Audio, WebGL, WebRTC and User-Agent fingerprints automatically match the profile
Cookies can persist between sessions or be wiped in one click
LSPosed is used only here — for the X-MAG built-in browser

Three levels of spoofing

Level 1. Native — a C/C++ library

Intercepts system calls before any app or browser reads them. Canvas and Audio are spoofed at the rendering engine level (Skia/Chromium), not via JavaScript — checkers don't see the masking. WebRTC Local IP is handled at the network-interface level, MediaDRM ID via JNI.

Level 2. System — device parameters

Consistent real-time spoofing of Android APIs and system parameters: hardware identifiers, build, telephony, GAID, GSF ID, battery, Wi‑Fi, geolocation, WebGL. For third-party and banking apps — without LSPosed and without Zygisk hooks inside their processes. LSPosed is required only for our built-in browser.

Level 3. Network — a proxy stack

HTTP, HTTPS, SOCKS4, SOCKS5, Shadowsocks. DNS-leak protection, header masking and a built-in proxy-detection test with recommendations.

Play Integrity — pass Google's check

A built-in wizard configures Play Integrity automatically, step by step and with the status of each component.

Basic & Device Integrity — the device passes as clean, with no traces of modification
STRONG Integrity — the highest level via keybox.xml import right inside the app
Modern stack: KernelSU Next + SUSFS + TEESimulator + Specter; LSPosed — only for the built-in browser

GEO compliance — one consistent picture

Anti-fraud cross-checks IP country, time zone, language, geolocation and the cellular network. A mismatch is the main red flag. X-MAG keeps all of it consistent within one profile.

Geolocation with realistic behavioural coordinate noise (NMEA)
Time zone — on the system and browser level at once
Language and locale aligned with the country
Carrier, network type and MCC/MNC match the region
Network and carrier parameters persist more reliably after reboot
Proxy — traffic routed through the target country's IP

Full list of spoofed parameters

Hardware identifiers

IMEI / IMSI (TelephonyManager API)
Android ID (Settings.Secure)
Device serial number
Wi-Fi and Bluetooth MAC address
GAID (Google Advertising ID), GSF ID, MediaDRM ID
GSF ID remains spoofed after Google Play services updates

Model & build

Model, manufacturer, brand, codename
Chipset, platform, GPU driver (Vulkan, OpenGL ES)
Build fingerprint, Android version, SDK, security patch

Cellular network

Carrier and MCC/MNC codes
Network type (4G/LTE/5G)
SIM phone number

Browser fingerprints

Canvas — at the Skia/Chromium level, not via JS
Audio — at the AudioBus/AAudio level, not via JS
WebGL Vendor / Renderer
WebRTC: SPOOF / BLOCK / RELAY-ONLY modes
User-Agent, navigator.platform, hardwareConcurrency, deviceMemory

Environment & sensors

Battery — 10 consistent parameters
Wi‑Fi environment: AP editor, geo-based generation, FAKE / REAL modes
Screen: resolution and density (DPI)
Camera / getUserMedia: front/back, fake media, resolution, FPS
Install metadata: source (Play Store and others), firstInstallTime and lastUpdateTime

Real-device mode

«My real device» mode: pick your model — invariant hardware (model, manufacturer, chipset, GPU) stays real, while per-device identifiers (android_id, serial, GAID, fingerprint, etc.) are regenerated and unique in every profile.

Ready to try?
Create an account and download the latest version.

Get started