Web

Mundane AI Apps Hide Abusive Deepfake Network

A network of more than 400 connected domains and apps masquerading as everyday AI tools has been found hiding secret features for generating explicit and violent deepfake content.

Radwan AbdulhadiEditor and technology writer

Published: November 2, 2026 · Updated: November 2, 2026 · 4 min read

Mundane AI Apps Hide Abusive Deepfake Network — Image: WIRED

Deceptive Apps Discovered Hiding Sexually Abusive Features

An investigation by WIRED uncovered a vast network of more than 400 connected domains and applications that appear to function as ordinary AI utilities but actually harbor hidden capabilities for generating explicit deepfake images and videos. Among them is an app called Viefur, which markets itself as a pet portrait generator that turns animal photographs into anthropomorphic scenes using digital coins purchased within the application. Behind this benign facade, however, researchers found that the app acts as a gateway for creating sexually abusive deepfake content.

According to findings shared by security researchers and investigators, the network includes various applications posing as everyday services, such as language tuition platforms and AI workout coaches. When accessed under specific conditions, these apps stealthily load a web interface that allows users to upload photos and generate explicit AI material, including violent scenes. Further details are available from AI slop in the original source material.

Exploiting Meta Ads and Official App Stores

The existence of this operation came to light after multiple researchers investigated the source of thousands of video ads containing explicit deepfake content published on Meta’s platforms, including Facebook and Instagram. Previous investigations into these promotional efforts have highlighted how the advertisements reached tens of thousands of users and drew scrutiny from global regulators.

The promotional campaigns systematically directed users toward deceptive applications hosted in official marketplaces like Apple and Google's app stores. This distribution channel enabled the operators to reach broad audiences, facilitate downloads, and process transactions using standard payment methods such as Apple Pay and Google Pay. Investigators noted that the network behind these nudify tools operated for approximately around a year, occasionally publishing dozens of new applications per week despite existing platform enforcement policies.

Technical Architecture and Bait-and-Switch Tactics

Analysis of the underlying code revealed sophisticated operational methods designed to evade initial review. When a user downloads one of the applications, the software makes a server call transmitting regional data, language settings, and a unique identifier. The server then determines whether to display the advertised benign interface or load the hidden web layer containing pornographic deepfake templates and payment mechanisms for digital currency known as diamonds.

Security researchers examining the digital infrastructure discovered extensive configuration lists embedded within JavaScript bundles. These files detailed hundreds of interconnected domains, encryption keys, and Facebook advertising trackers, confirming that the apps were part of a centrally managed, commercial operation.

Scale of Operations and Developer Origins

Domain registration analysis indicates that the apps began proliferating toward the end of 2025, with a notable surge occurring in the spring of the following year. At peak activity, operators registered roughly 30 nudify domains weekly, accumulating over 350,000 collective downloads on Google's Play Store alone. Many of these listings were categorized as suitable for all age groups.

The web domains and associated operations have been linked to Chinese-language developers and a Hong Kong-registered entity named KeLing Technology Limited. Requests for comment sent to email addresses associated with the entity went unanswered, and public ties between the firm and the deepfake tools were systematically erased following initial outreach from journalists.

Platform Responses and Content Removal

Ahead of media inquiries, Google removed the majority of the offending applications from the Play Store, including a popular program named DiffAI that had surpassed 100,000 downloads. Apple similarly removed 19 applications from its App Store, including the Viefur pet portrait app, after receiving inquiries and associated domain lists.

An Apple spokesperson stated that the applications complied with store guidelines during initial reviews but subsequently utilized bait-and-switch tactics to swap approved content for prohibited pornographic material by altering the underlying web sources after publication. The company noted that it has suspended tens of thousands of apps employing similar methods over the past year.