Investigation Uncovers Network of 400+ Disguised Apps Hiding Sexual Deepfake Tools

A WIRED investigation, published today (November 2), has exposed a massive and sophisticated network of more than 400 interconnected apps and domains that present themselves as ordinary services—pet portrait generators, language learning apps, AI fitness coaches—but which, under certain conditions, load a hidden interface capable of generating sexually explicit and violent images and videos from user-uploaded photos.

What makes the case particularly alarming is not just the scale, but the evasion architecture: the apps passed reviews by Apple and Google with benign content, then dynamically altered their loaded content through server-side checks, replacing approved material with sexual deepfake tools. One identified trigger is the simple act of downloading the app after clicking an ad for these apps on Meta's platforms.

Behind the facade

Security researchers' analysis, including that of Maël Le Touz from Infoblox—who mapped nearly 500 linked domains—and Paul Bouchaud, who found 27 active apps on Google Play in September with over 350,000 combined downloads, revealed a pattern of industrialized operation. Starting from late 2025, the network was registering dozens of new domains per week—around 30 at one point.

One of the most emblematic apps is Viefur, which describes itself as a pet portrait generator. In the main interface, users can upload a photo of a hamster and see it wearing beach shorts on the shore. Behind that, however, the app offers templates with scenarios labeled "bedroom rape" and "threatening knife," where a man holds a knife to a woman's neck.

The JavaScript code on the network's websites contains, easily accessible, details about the entire operation: a list of all domains and apps created by the developers, app package details, encryption keys, Facebook advertising trackers, and more. It's as if the operators themselves had left the blueprints of the crime scene scattered across the table.

The Chinese connection

The investigation linked the network to Chinese-language developers and a Hong Kong-registered entity called KeLing Technology Limited. The connection is backed by concrete evidence: hosting in China, comments in Chinese within the source code, and watermarks from Chinese video-editing software on promotional materials. KeLing did not respond to WIRED's requests for comment.

Meta revealed it had already banned KeLing from its advertising platform in 2025 and subsequently took action against accounts, pages, and ads associated with the network's domains—totaling 11,600 ad accounts, thousands of pages, and 209 apps. But according to WIRED, similar ads and apps continued to appear even as the report was being finalized.

How platforms responded

After WIRED's outreach, Apple removed 19 apps from the App Store, including Viefur. An Apple spokesperson, Adam Dema, explained that the apps complied with the rules during initial review, but developers later changed the website from which the app pulled content after approval, replacing approved material with pornography.

Apple stated it has suspended tens of thousands of apps over the past year for similar bait-and-switch tactics. In October, the company had already strengthened its rules against nudification apps and bait-and-switch tactics, extending the ban beyond the official App Store to include alternative distribution.

Google, meanwhile, had already removed most of the apps before WIRED even contacted it. The app DiffAI, with over 100,000 Play Store downloads, was removed shortly before the company was reached. Google did not respond to the request for comment.

A broader problem

This is not the first case of sexual deepfake apps in app stores. In August 2026, WIRED reported that Meta ran ads for an app called Kromix promoting sexually explicit deepfakes of real women, including one resembling a prominent U.S. political figure. In January 2026, the Tech Transparency Project investigation revealed that Google and Apple hosted dozens of "nudify" apps.

What distinguishes this investigation is the industrial scale of the operation. This is not an isolated amateur developer, but an organized enterprise with robust technical infrastructure, monetization through Apple Pay and Google Pay, and promotion via thousands of explicit ads on Facebook and Instagram—some of which linked directly to the app stores.

Infoblox's research also found that the apps checked user location and language settings before deciding which version of the interface to display. This profile-based dynamic content delivery is the same technique used by malware to target specific victims.

What to watch

The case raises structural questions about the review model for apps on major platforms. Apple states it reviews all apps before publication, but the ability to modify content after approval creates a loophole that sophisticated operators could exploit indefinitely. The question is whether Apple's rule updates and mass removals are sufficient to contain a network that continued launching new domains and apps while the investigation was being conducted—or whether the current review model is simply inadequate for handling apps that change behavior in real time.

Sources: WIRED, 9to5Mac, Nuaico

✓ Independent sources cross-checked and verified before publishing