WIRED Finds Hundreds of AI Apps That Hid Abusive Deepfake Features

WIRED traced more than 400 connected apps and websites that could conditionally load explicit deepfake interfaces behind ordinary AI services. [1]

Researchers found templates depicting sexual violence and threats, with users paying for credits to generate images and videos from uploaded photographs. [2]

Apple removed 19 apps after WIRED shared its findings; Meta later said it had taken action against thousands of linked accounts, pages and users. [3]

The investigation highlights a review gap: developers can pass an app-store review and later change the content delivered by remote servers. [4]

A network of more than 400 apparently ordinary AI apps and websites hid tools for generating sexually abusive deepfakes, according to a WIRED investigation published November 2, 2026. The services presented themselves as pet portrait generators, language tutors and fitness tools, but under certain conditions loaded interfaces for creating explicit images and videos from uploaded photographs. [1]

WIRED said it identified the network through domain records, app behavior, source-code analysis and interviews with outside researchers. The investigation linked many of the services to Chinese-language infrastructure and a Hong Kong-registered company, KeLing Technology Limited. That does not establish that every developer or operator was Chinese, and KeLing did not respond to WIRED’s requests for . [5]

Remote controls exposed a second layer

Researchers found hidden templates depicting sexual violence and threats, including scenes involving a knife. Users could upload photographs and buy in-app credits or “diamonds” to generate content. The associated websites also linked to social-media accounts used to the operators. [7]

The network’s code contained a configuration list with related domains, app-package details, encryption keys and advertising trackers. Infoblox researcher Maël Le Touz told WIRED that he identified almost 500 linked domains using common code and references. [8]

WIRED reported that the network began appearing in late 2025 and at one point registered 30 apps and websites a week. In September, 27 related apps were live on Google Play and had recorded more than 350,000 downloads collectively, according to Bouchaud’s research. DiffAI, one of the more popular apps, had exceeded 100,000 downloads before Google removed it. [9]

Platforms responded after researchers raised alarms

Apple removed 19 apps, including the pet-photo app Viefur, after WIRED shared information the network. Apple said the apps complied with its rules when reviewed, then changed the websites they retrieved content from after approval. The company described that as a bait-and-switch tactic and said it had suspended tens of thousands of apps for similar conduct over the year. [10]

Apple updated its App Review Guidelines on October 16 to explicitly address AI-generated nonconsensual intimate imagery and hidden features. The revised rules say apps must proactively prevent and remove such content, and that developers can be removed from the App Store and developer program for misrepresenting an app during review. [11]

Google Play’s policies prohibit AI-generated nonconsensual deepfake sexual material and require developers of generative-AI apps to prevent prohibited content and provide in-app reporting tools. Google did not respond to WIRED’s request for , although WIRED reported that Google had removed most of the identified apps before being contacted. [12]

Meta said it had banned KeLing Technology Limited from advertising in 2025 after the company failed to comply with a cease-and-desist letter. After receiving more than 400 domains from WIRED, Meta said it identified over 3,000 associated ads and later took action against 11,600 ad accounts, more than 4,700 business pages, 5,200 users and 15,000 pages. It also said it blocked 209 apps from advertising on its services. [13]

The enforcement problem is architectural

The case shows why ordinary app-store review can miss harmful functionality. A reviewer may assess the software and content visible at submission, while a developer later changes what a remote server delivers. That makes abuse harder to detect when operators rotate domains, developer identities and advertising accounts. This is an inference from the technical behavior described by WIRED and the platforms’ explanations, not an independent test of the apps. [14]

The wider ecosystem has produced similar enforcement concerns. Meta has acknowledged the growth of “nudify” services and sued a Hong Kong-based operator over advertising them. The company says it bans promotion of such tools and is developing ways to detect and signals them. [15]

Google also published a dedicated safety notice in August 2026 warning developers AI-facilitated nonconsensual intimate imagery and specifically calling out nudify, undress and deepfake tools. [16]