Hundreds of Apps Hid Deepfake Tools Behind Pet Portraits

The app looked harmless. It made portraits of your pet. Or it coached your workouts. Or it taught you a language. Then, under the right conditions, it turned into something else entirely.

A WIRED investigation published November 2 traced a network of more than 400 connected apps and web domains that passed review on Apple's App Store and Google Play disguised as everyday AI tools, then loaded a hidden interface for generating sexually abusive deepfake images and video from photographs of real people. Researchers at the nonprofit AI Forensics and the cybersecurity firm Infoblox mapped the network and tied it to a Hong Kong-registered company called KeLing Technology Limited, which did not respond to requests for comment.

The trick was a server-side switch. After installation, an app contacted a remote server and sent details including the user's language, referral source, and a unique identifier. The server then decided what the user saw: the advertised features, or a separate web page with deepfake generators. The apps began appearing in late 2025, and at their peak, researchers found, about 30 new app-and-website pairs were registering each week.

How the disguise worked

The storefront versions were convincing. One example WIRED named was Viefur, a pet portrait app that turned animal photos into humanlike characters. Behind that interface, researchers found tools that placed people into sexually explicit scenes, including scenes depicting sexual assault.

The network spread through advertising. Meta said it acted against 11,600 ad accounts tied to the operation and blocked 209 apps from advertising on its platforms. Some ads linked directly to App Store and Google Play listings, and users who arrived through them could buy digital credits through Apple Pay or Google Pay to generate images. Viefur sold 130 coins for $4.

The scale on Google Play was concrete. In September, researchers found 27 of the network's apps live on the store with more than 350,000 combined downloads, including an app called DiffAI with more than 100,000 installs. Many carried all-ages ratings. Google removed most of the flagged titles before WIRED contacted it. Apple removed 19 apps, including Viefur, after WIRED shared its findings.

What the companies said

Apple spokesperson Adam Dema said the apps complied with App Store rules during their initial reviews, and that the developers later changed the remote websites feeding content to the apps. Apple said it suspended tens of thousands of apps over the past year for similar bait-and-switch tactics. On October 16, the company updated its App Review Guidelines to explicitly cover AI-generated nonconsensual intimate imagery and apps that conceal functionality during review.

Meta said it had banned KeLing Technology Limited from advertising in 2025 after the company failed to comply with a cease-and-desist letter. Infoblox threat researcher Maël Le Touz mapped nearly 500 linked domains and found the apps shared identical JavaScript configurations and cross-referenced encryption keys. The researchers pointed to Chinese-language code, Chinese hosting services, and watermarks from Chinese video-editing software on promotional materials as the trail back to the operator.

The investigation also showed the limits of the cleanup. WIRED reported that similar ads kept resurfacing even as the investigation wrapped up. The European Union's ban on nudifier apps takes effect in about a month, which will test whether regulation does what store review did not.

The practical lesson is blunt: a listing in an official store is not proof an app is safe to hand your photos to. The apps in this network passed review precisely because the harmful part was not in the app at all. It arrived later, from a server, after the reviewers had moved on.