WIRED Finds a Network of More Than 400 Apps and Domains That Hid Sexual Deepfake Generators Inside Pet-Portrait and Language Apps on Apple's and Google's Stores
WIRED reported on November 2 that more than 400 connected apps and domains, posing as everyday AI tools, quietly loaded an interface for making explicit deepfakes of uploaded photos when users arrived under certain conditions, such as clicking a Meta ad. Researchers linked the network to Chinese-language developers and a Hong Kong-registered company, KeLing Technology Limited, which did not respond. Apple removed 19 apps after WIRED's questions and says the developers swapped content after review; Meta says it has taken action against 11,600 ad accounts.
App store review checks what an app shows on the day it is reviewed, and a network of more than 400 connected apps and domains was built to get around exactly that. WIRED reported on November 2 that apps posing as ordinary AI services, such as a pet-portrait generator called Viefur, language tutors and workout coaches, would load a hidden web interface for making explicit deepfake images and videos from users' uploaded photos when users arrived under certain conditions.
How the switch worked#
Each time one of the apps was downloaded, it sent information about the user to a server, which replied whether to show the harmless version or the explicit one, according to Paul Bouchaud, a lead researcher at the nonprofit AI Forensics who reverse-engineered the code. One trigger appears to be installing the app after clicking an associated ad on Facebook or Instagram. A configuration list hidden in the websites' code named the rest of the network; Maël Le Touz of the security firm Infoblox said he found almost 500 linked domains that "run the same code and they all reference one another."
Bouchaud's research found that about 30 apps and sites were being registered each week at one point, with 27 live on Google Play in September and more than 350,000 downloads between them. Many were rated suitable for all ages. One app, DiffAI, had more than 100,000 downloads from Play before it was removed. WIRED has previously reported that some ads linked to the network contained AI-generated child sexual abuse material.
"This is an organized, commercially run operation," Bouchaud told WIRED. "They don't expect enforcement to catch up, and so far it hasn't."
Who is behind it, and what the platforms did#
WIRED linked the apps to Chinese-language developers and a Hong Kong-registered entity, KeLing Technology Limited, based on domain records and how the services operate. Email addresses linked to the company did not respond, and after WIRED's inquiries, public connections between KeLing and the tools were removed.
Apple removed 19 apps, including Viefur, after WIRED shared the domains. Spokesperson Adam Dema said the apps "complied with our rules when we reviewed them," and that their developers later changed the website the apps pull content from. Google did not comment but had removed most of the apps before WIRED contacted it. Meta said it banned KeLing from advertising in 2025 and has since taken action against 11,600 ad accounts, more than 4,700 business pages, 5,200 users and 15,000 pages linked to the domains, and blocked 209 apps from advertising.
WIRED said similar ads and apps were still being published as it finished its reporting. Rules such as the EU AI Act's deepfake labelling duty, enforceable since August 2, apply to content a system produces; this network was built so that reviewers would not see the explicit version at all.
Limits#
- The attribution to KeLing and Chinese developers is WIRED's and the researchers' reading of domain and code evidence; KeLing has not responded.
- Download counts come from Bouchaud's research and Play Store listings; we did not verify them independently.
- We have not tested any of the apps and do not name the explicit features.