WIRED uncovers 400-plus apps and domains hiding abusive AI deepfake tools

More than 400 connected apps and web domains disguised sexually abusive AI deepfake tools as ordinary services, a WIRED investigation published November 2 found. Apps advertised as pet portrait makers, language tutors and workout coaches could instead load hidden interfaces that turned uploaded photographs into explicit images and videos, including depictions of sexual violence.

Researchers uncovered the network by following links from thousands of explicit video advertisements on Facebook and Instagram. Those ads directed people to deceptive apps in Apple’s and Google’s stores. WIRED reported that hundreds of the ads contained AI-generated child sexual abuse material, including images using photographs of real children.

The server decides which app users see

The disguise was more than a misleading store description. Paul Bouchaud, a lead researcher at nonprofit AI Forensics, reverse engineered the apps and associated websites. He found that an app contacted a server with information such as the user’s origin, language and a unique identifier. The server then decided whether to display the benign service or the explicit interface.

Researchers had not identified a complete set of triggers. One apparent trigger was downloading an app after clicking an associated Meta advertisement. Visiting an app’s website directly could produce only a black screen, even though that website hosted the explicit interface loaded inside the app.

That hidden interface offered dozens of sexual image and video templates. Users could upload someone’s photograph and buy digital credits called diamonds to generate the material. It also linked to social media accounts where users could contact the developers with questions or complaints.

Shared code exposed the connections

The websites’ code also exposed the network’s structure. Researchers found a JavaScript bundle containing a configuration list of related domains and apps, alongside app package details, encryption keys and Facebook advertising trackers. Maël Le Touz, a staff threat researcher at security firm Infoblox, identified almost 500 linked domains through his investigation.

They run the same code and they all reference one another.

Maël Le Touz, Infoblox staff threat researcher, speaking to WIRED

Bouchaud’s research traced the network’s emergence to late 2025, followed by a surge in spring 2026. At one point, roughly 30 app-and-website combinations were being registered each week. In September, 27 apps were live on Google Play; collectively, those apps had more than 350,000 downloads, and many carried ratings suitable for all ages.

WIRED linked the operation to Chinese-language developers and Hong Kong-registered KeLing Technology Limited, citing domain records, contact addresses and an administration login page mentioning Keling. Le Touz also pointed to Chinese hosting and Chinese-language code comments. These were technical and registration links, not a public acknowledgment of ownership by the company.

KeLing-linked email addresses and other contacts did not respond to WIRED’s requests for comment. After those inquiries, KeLing addresses disappeared from associated websites and some related social media channels were renamed, WIRED observed.

Removals followed, but distribution continued

• Apple removed 19 apps, including pet portrait app Viefur, after WIRED shared its findings. Apple said developers had replaced approved website content with pornography after app review.
• Google had removed most of the identified apps before WIRED contacted it. DiffAI, which had exceeded 100,000 Play Store downloads, was removed shortly before the inquiry. Google did not comment.
• Meta said it took action against 11,600 ad accounts linked to the domains and blocked 209 apps from advertising on its platforms.

Meta said it had already banned KeLing from advertising in 2025 after the company failed to comply with a cease-and-desist letter. It said the company continued trying to advertise through other routes, using deceptive identities and destinations. As WIRED completed its investigation, similar ads and apps were still being published.