.png "Global Insight")
It looked like a pet portrait maker. Or a language tutor. Or a workout planner. According to a WIRED investigation published on Monday, more than 400 connected apps and websites presented themselves as exactly those kinds of ordinary services — while hiding, behind a server-side switch, tools for generating sexually abusive deepfake images and videos from uploaded personal photographs. Apple and Google have since removed apps named in the investigation, but researchers say similar apps and ads were still appearing as the reporting concluded.
The trick was cloaking. When reviewers or ordinary visitors opened the apps, they saw a harmless utility — sometimes just a black screen or a basic photo tool. But when a user arrived through a targeted video ad on Facebook or Instagram, the app checked details such as location, language, device identifier and how the user found it, then asked a remote server which version to show. For those users, the server loaded a hidden web interface offering explicit deepfake templates, including scenarios involving sexual assault and threats. Users could buy digital credits through Apple Pay and Google Pay to generate images from real photos they uploaded.
How big was the network?
Researchers mapped a coordinated cluster far larger than a handful of rogue apps. Security firm Infoblox researcher Maël Le Touz identified almost 500 linked domains, many running the same code and referencing one another, while nonprofit research group AI Forensics traced registrations back to late 2025, with as many as 30 new domain-and-app combinations registered per week at the peak. In September, 27 of the apps were live on Google Play, with more than 350,000 downloads combined — many carrying all-ages ratings. One app, DiffAI, logged over 100,000 installs before Google removed it shortly before WIRED contacted the company.
The investigation traced links to Chinese developers and a Hong Kong-registered entity called KeLing Technology Limited, citing Chinese hosting services, Chinese-language code and watermarks from Chinese video-editing software on promotional material. The company did not respond to requests for comment, according to reports. Meta said it had banned KeLing from advertising in 2025 and later acted against 11,600 ad accounts, 5,200 users and 209 apps tied to the scheme — though WIRED found similar ads still surfacing.
What the stores did — and what changed
Google had removed most of the flagged titles before WIRED contacted it. Apple removed 19 apps, including the pet portrait app Viefur, after the outlet shared its findings; Apple said the submitted software complied with its guidelines during initial review, but developers later changed the remote websites feeding content to the apps. On October 16, Apple updated its guidelines to tighten restrictions on apps that conceal functionality during review, with new rules covering nonconsensual intimate imagery and hidden, dormant or undocumented features. Apple also says it has suspended tens of thousands of apps over the past year for similar bait-and-switch tactics.
That history is the real lesson here. An official store listing is a checkpoint, not a guarantee: if an app can change what it shows after approval by consulting a remote server, the review that approved it never saw the version users actually get. The European Union's ban on nudifier apps takes effect in about a month, according to reports, adding legal pressure on top of store enforcement.
What this means for users
Three practical defences follow from how the scheme worked. First, treat unfamiliar apps asking for personal photos with suspicion, however mundane they look — especially ones reached through a social-media ad rather than a direct store search. Second, check the developer: a pet app with no verifiable developer history, or a cluster of near-identical apps from the same publisher, is a warning sign. Third, remember that payment through Apple Pay or Google Pay does not make the app legitimate; these apps used those very rails to sell credits. Related reading: Google Shuts Down XCPE Botnet Hidden in 1.3 Million Android TV Boxes and Ukraine Air-Alert App Hacked With False Radiation Warnings. Sources: Digital Trends and Silicon Report.