More than 400 apps and websites presented as ordinary AI services were found to be connected to hidden tools for generating sexually abusive deepfake images and videos, according to an investigation by WIRED. The services included apps marketed for pet portraits, language learning and AI fitness coaching.
One example, the pet portrait app Viefur, allowed users to turn animal photographs into stylized scenes. Researchers found that, under certain conditions, the app could instead load a web interface offering explicit sexual templates, including violent scenarios, and tools for adding uploaded photographs to generated content.
The apps appeared to determine remotely whether a user would see the advertised benign features or the explicit interface. According to Paul Bouchaud of AI Forensics, the decision could take into account information such as the user’s source, language and a unique identifier. Installing an app after clicking an advertisement on Facebook or Instagram appeared to be one possible trigger for displaying the hidden content.
Researchers also found that associated websites could appear blank while still hosting the explicit layer used by the apps. Their code contained configuration data linking numerous domains and applications, including encryption keys and advertising trackers. Maël Le Touz, a threat researcher at Infoblox, identified almost 500 connected domains that used similar code and referenced one another.
The network began appearing toward the end of 2025 and expanded sharply in the spring of 2026, according to the investigation. At one point, around 30 related apps and websites were being registered each week. In September, 27 of the apps were available on Google Play and had accumulated more than 350,000 downloads, with several classified as suitable for all ages.
DiffAI, one of the most downloaded apps, was created in December 2025 and exceeded 100,000 Google Play downloads. A user review alleged that it offered templates for child sexual abuse material and other pornography without age verification. Google removed DiffAI before WIRED requested comment and had already removed most of the apps identified by the investigation.
Apple removed 19 apps, including Viefur, after WIRED shared information about the activity and related domains. Apple spokesperson Adam Dema said the apps had initially complied with the company’s rules, but their developers later changed the websites supplying their content and replaced the approved material with pornography. Apple described the tactic as a bait-and-switch and said it had suspended tens of thousands of apps using similar methods during the previous year.
The apps and websites appeared to be operated by Chinese-language developers. Researchers cited Chinese hosting, Chinese comments in the code and Chinese-language editing software watermarks in promotional videos. The services used generic privacy policies, free email accounts and obscure developer names, while advertisements on Meta’s platforms often ran under apparently false identities and pages without followers.
Since the beginning of 2026, researchers found tens of thousands of explicit deepfake advertisements linked to the network on Meta’s services. The ads included content depicting minors, prompting investigations by regulators, and directed users to apps in Apple’s and Google’s stores, where payments could be made through Apple Pay and Google Pay.
A Hong Kong-registered company, KeLing Technology Limited, appeared repeatedly in the network’s infrastructure and contact information. After WIRED sought comment from email addresses associated with the company and its services, some public references to KeLing were removed or changed. Meta said it had banned the company from advertising in 2025 after it failed to comply with a cease-and-desist letter.
After receiving a list of more than 400 domains from WIRED, Meta said it identified over 3,000 associated advertisements and had already removed about two-thirds of them. The company later reported action against 11,600 advertising accounts, more than 4,700 business pages, 5,200 users and 15,000 pages linked to the domains, as well as blocking 209 apps from advertising on its platforms. Similar apps and advertisements were still being published as the investigation concluded.
Sources: WIRED.