400-App Deepfake Network Hid Abuse Tools Behind Pet Portraits

A WIRED investigation has uncovered a network of more than 400 connected apps and domains that disguise sexually abusive deepfake generation tools as mundane services such as pet portrait generators, language tuition, and AI workout coaches. The apps stayed live on Apple's App Store and Google's Play Store for roughly a year, collecting more than 350,000 downloads, despite policies at both companies that prohibit harmful deepfake content.

The case matters beyond one takedown cycle. It shows how "nudify" operators (tools that strip clothing from uploaded photos using AI) can pass app store review, process payments through Apple Pay and Google Pay, and buy distribution on Meta's ad platform at industrial scale — while regulators worldwide investigate the same ad ecosystem for hosting AI-generated child sexual abuse material.

What did the network look like to users?

Take Viefur, a self-described pet portrait app. For around $4, users buy 130 digital coins to turn pet photos into "anthropomorphic portraits" — a hamster in beach shorts by a pool, a cat in a Hawaiian shirt drinking from a coconut. Researchers found this was cover for the app's apparent true purpose: generating sexually abusive deepfake images.

Under certain conditions, apps in the network quietly loaded a hidden web interface instead of the advertised product. That interface contained dozens of explicit deepfake video and image templates, including scenes labeled "bedroom rape" and "threatening knife," where a man holds a knife to a woman's neck. Users could upload photos of real people into the sexual scenes and pay for "diamonds" to generate images.

Paul Bouchaud, a lead researcher at the nonprofit AI Forensics who investigated the network, called it an organized commercial operation. "This is an organized, commercially run operation: One operator behind hundreds of disposable apps and domains, cloaked to pass App Store review and pushed through tens of thousands of Meta ads under fake payer names," Bouchaud said. "They don't expect enforcement to catch up, and so far it hasn't."

How did the apps hide their behavior?

The apps made server-side decisions about which version to show, according to Bouchaud, who reverse engineered the apps' and associated websites' code. "Each time the application is downloaded, there is a call to the server with some information, such as where the user is coming from, the language, some unique identifier, and then the server replies whether or not to show the explicit or the non-explicit version of it," he explained.

Researchers found no definitive list of triggers, but one apparent signal: downloading an app after clicking an associated ad on Meta's platforms. The hidden layer was technically simple. The apps' websites displayed a black screen with no content — the only visible change was the URL updating to include the word "risk."

The operators also left their own map. A JavaScript bundle that researchers could easily unpick contained a list of all domains and apps created by the developers, including app package details, encryption keys, and Facebook advertising trackers. "They contained this giant configuration list of other domains with different encryption keys," said Maël Le Touz, a staff threat researcher at security firm Infoblox, who identified almost 500 linked domains. "They run the same code and they all reference one another."

Takeaway: the cloaking was a server-side switch, not sophisticated obfuscation — and the operators documented their own infrastructure in publicly viewable code.

How big was the operation?

Bouchaud's analysis of domain registrations found the apps began appearing toward the end of 2025, with a spike in spring. At one point, around 30 nudify apps and websites were registered each week. In September, 27 were live on Google's Play Store, many rated suitable for all age groups.

One of the most popular apps, DiffAI, launched in December 2025 and drew more than 100,000 Play Store downloads. A user review on the store stated: "This app contains templates for creating CSAM and other types of pornographic material. It performs no age verification." Portions of the network were previously reported by Danish journalists in September.

The ads drove the downloads. Bouchaud's research found tens of thousands of explicit deepfake ads linked to the network on Meta's platforms since the start of the year, often using similar ad copy. Multiple researchers traced the network after investigating links from thousands of video ads containing explicit deepfake content on Facebook and Instagram — ads WIRED previously reported included AI-generated child sexual abuse material depicting real children and a member of a European royal family, reaching tens of thousands of people and prompting regulator investigations worldwide.

What did Apple, Google, and Meta do?

DiffAI was removed from the Play Store shortly before WIRED contacted Google about the network. Google removed the majority of the apps before being contacted and did not respond to a request for comment.

Apple removed 19 apps, including Viefur, after WIRED shared associated domains. "We designed the App Store to be a safe and trusted place for our users, and nudification apps and other pornographic content are strictly prohibited," Apple spokesperson Adam Dema said. He attributed the lapse to post-approval manipulation: "We review every app before it's published, and these apps complied with our rules when we reviewed them. After approval, their developers changed the website the app pulls its content from, replacing what we approved with pornographic content, and promoted it through pornographic ads hosted on a third-party platform." Apple says it has suspended tens of thousands of apps for these "bait-and-switch" tactics over the last year and recently updated its rules to further restrict nudify tools.

Meta says it banned KeLing Technology Limited from advertising in 2025 after the company failed to "comply with a cease and desist letter," which Meta declined to share citing legal reasons. "We have strict rules against promoting nudify apps and work aggressively to keep this material off our services," a Meta spokesperson said. After WIRED shared the 400-plus domains, Meta said it had identified more than 3,000 associated ads, two-thirds already removed. The company later reported action against 11,600 ad accounts, more than 4,700 business pages, 5,200 users, and 15,000 pages, blocking 209 apps from advertising.

The spokesperson acknowledged the evasion problem: "The criminals behind them take increasingly deceptive steps to evade detection—hiding behind fake names and identities, running ads that look benign, and sometimes linking to Google's and Apple's app stores, with the ads' true intent revealed only after a click."

Takeaway: every platform acted only in volume and after pressure; none has explained how the network survived a year of simultaneous distribution and payment rails.

Who is behind it?

The network appears to be run by Chinese developers and a Hong Kong-registered entity, KeLing Technology Limited, based on a review of web domains and service operations. Le Touz cited exclusive Chinese hosting, code written and commented in Chinese, and watermarks from Chinese-language video editing software in the Meta ads. The operators used generic privacy policies, free Gmail and Outlook addresses, obscure developer names, and apparently false ad payer names such as Draftmondcreldreldbro Duhustepre and Swaldmungsha Glasirdcroldshold.

KeLing's fingerprints were everywhere: its name appeared in contact details for the network's first registered website and within an explicit deepfake template; Bouchaud found an administration login page referencing "Keling"; and a company-domain email appeared on at least one removed app. In late September, users were notified of a new AI model called Veyra, tagged "More real. More natural. More wild." The Veyra AI website listed a KeLing contact email.

WIRED received no response from KeLing-linked email addresses. After WIRED reached out, someone renamed associated social media channels, removed KeLing emails from the Veyra site, and stripped the company address from the first registered website.

Katie Paul, director of the Tech Transparency Project, who first uncovered the ads depicting minors, said the ads violate several Meta policies at once. "There is no question about what you are seeing, what the app is advertising," she said. She argues companies must answer where the revenue goes and how nudify operators keep bypassing moderation.

As WIRED finished reporting, similar ads and apps continued to appear on the platforms — the clearest signal that a banned entity, renamed domains, and a fresh batch of disposable apps remain a workable business model.