Wired finds 400-plus disguised apps and sites hiding explicit deepfake tools; Apple pulls 19

Wired has traced a network of more than 400 linked websites and apps that present themselves as harmless AI tools while hiding a second face: a web interface for generating sexually explicit and violent deepfake images and videos. The disguises include language lessons, AI workout coaching and a pet-portrait app. After Wired asked about them and shared the domains, Apple removed 19 apps from the App Store, among them a pet-photo app called Viefur. Google had already taken down most of the apps before Wired made contact and declined to comment.

The trick is a switch controlled from a server. Each time an app opens, it reports the user's location, language and a device identifier, and gets back either the innocent version or the explicit one. Downloading after tapping a Meta ad is one of the triggers. The linked websites show a plain black screen unless "risk" is added to the address, which reveals dozens of deepfake templates and a currency of "diamonds" spent on generations. Some template titles describe sexual violence and threats with a knife. Code shared across the sites lists every domain and app in the network, together with encryption keys and Facebook ad trackers, and researchers at Infoblox counted close to 500 connected domains.

“This is an organized, commercially run operation: One operator behind hundreds of disposable apps and domains, cloaked to pass App Store review and pushed through tens of thousands of Meta ads under fake payer names.”

Paul Bouchaud, lead researcher, AI Forensics, to Wired · wired.com ↗

The timeline is quick. Apps began to show up in late 2025 and spiked in spring 2026, at one point with about 30 new app-websites registered a week. In September 2026, 27 of them were live on Google Play with more than 350,000 downloads between them, and one called DiffAI, created in December 2025, passed 100,000 downloads before it was removed. All of them passed review at Apple, Google and Meta, which each ban harmful deepfake content, and took payments through Apple and Google Pay. The developers appear to be Chinese, with a Hong Kong entity named KeLing Technology Limited attached; after Wired got in touch, public links to it were scrubbed. Users of the explicit interface were told in late September about a new model, Veyra, and its site listed a KeLing contact.

Meta's part is the advertising. Wired found tens of thousands of explicit deepfake ads since the start of 2026, placed under invented names and through pages with no followers. Meta says it has acted against 11,600 ad accounts, more than 4,700 business pages, 5,200 users and 15,000 pages, and has barred 209 apps from advertising. Of more than 3,000 ads Wired passed on, about two-thirds were already gone. Meta says it banned KeLing from advertising in 2025 after the entity ignored a cease-and-desist letter, but the operation kept trying other routes.

Apple's position is that the apps followed its rules when they were reviewed, and that the developers later changed the website the app pulls its content from and promoted it with pornographic ads on a third-party platform. It says it has suspended tens of thousands of apps for bait-and-switch behaviour over the past year and recently tightened its rules on nudify tools. Researchers describe a commercial operation built on the expectation that enforcement lags behind. The Tech Transparency Project wants the companies to explain where the money goes and how the operators keep slipping past moderation.

Meta, for its part, says it has strict rules against promoting nudify apps and works aggressively to keep such material off its services. The ads Wired found were not subtle about what they sold, according to the director of the Tech Transparency Project, who said there was no doubt about what the apps were advertising. The ads used invented names and pages with no followers, and people who tapped one and then installed an app became a trigger for the explicit version to load. Because the explicit layer lived on a website rather than inside the app, a removal did not end the operation: the developers could change the site, register another domain and launch a fresh app. Researchers say the operators appear to expect enforcement to lag behind them, and the Tech Transparency Project wants Apple, Google and Meta to say where the money from the payments and ads ends up.

Apple has also been pressed on this before. A city attorney, the Tech Transparency Project and Wired's own earlier reporting have each pointed at nudify apps in its store in 2026, and the company has responded by removing individual apps and rewriting its review rules, as the background below sets out. Even so, Wired's reporting shows the newest group of apps getting through at all three companies at once, with similar ads and apps still being published as the reporters finished, and public traces of the KeLing entity wiped only after the questions arrived.

Wired adds that it earlier reported hundreds of Meta ads carrying AI-generated child abuse material, now under regulator investigation, and that Danish journalists had reported parts of the network in September.