An app that turns your dog into a cartoon character sounds harmless enough that you might hand your phone to a kid to try it. A WIRED investigation published on November 2 found that more than 400 apps like that one, on Apple's App Store and Google Play, were hiding something else entirely. Behind the pet portraits, language lessons, and workout plans sat tools for generating sexually explicit deepfakes of real people, and the apps were built to keep that second face hidden from the people whose job it is to catch it. Researchers from the nonprofit AI Forensics and the security firm Infoblox traced the network to more than 400 connected apps and roughly 500 linked web domains, and the scale of it is what makes the story hard to shrug off.
How the trick worked
The apps passed review because the thing reviewers saw was not the thing users got. When someone installed one of these apps, it quietly contacted a remote server and sent along details like the user's location, language, device identifier, and how they found the app. The server then decided which version to show. A reviewer, or an ordinary user who found the app on their own, got the harmless pet portraits or workout routines. Someone who arrived by clicking an ad on Facebook or Instagram could get a hidden web interface loaded with dozens of explicit deepfake templates, letting them upload a real photo and drop that person into sexual scenes, including ones involving threats and violence. The apps even sold digital currency to pay for generations, and some took payment through Apple Pay and Google Pay, which made the whole thing look as ordinary as buying extra lives in a game. The network was not a handful of copycats. The apps shared the same JavaScript code, the same encryption keys, and the same advertising trackers, which is how researchers knew they were looking at one coordinated operation rather than a coincidence.
Who was behind it
WIRED traced much of the network to Chinese developers and a Hong Kong-registered company called KeLing Technology Limited, which scrubbed its online presence after reporters got in touch and did not respond to requests for comment. The apps started appearing in late 2025, and at their peak about 30 new app and domain pairs were registering every week. The reach was not small. In September, researchers found 27 related apps on Google Play with more than 350,000 downloads between them, and 20 of the network's apps were rated as suitable for children. One app alone, DiffAI, passed 100,000 downloads before Google pulled it. The network also ran a huge advertising operation on Meta's platforms, with more than 84,000 ads since the start of the year, sometimes placed under fake business names by accounts with no followers. Which should make Meta uncomfortable, because they are how the hidden version of the apps found its audience, and they kept resurfacing even as WIRED was wrapping up its investigation.
How the app stores reacted
Apple removed 19 apps, including the pet portrait app Viefur, after WIRED shared its findings, and Google removed most of the flagged titles before WIRED even contacted the company. Apple spokesperson Adam Dema said the apps had complied with the store's rules during their initial reviews and that the developers later changed the websites feeding them content, swapping approved material for pornography. Apple also updated its App Review Guidelines on October 16 to explicitly cover AI-generated nonconsensual intimate imagery and hidden features. Meta says it banned KeLing from advertising in 2025 and has since taken action against 11,600 ad accounts and 5,200 users, and blocked 209 apps tied to the scheme. The responses sound decisive until you remember the timeline. These apps were live for months, some of them rated for children, and they were only found because outside researchers went looking. The European Union's ban on nudifier apps takes effect in about a month, which should help, but a ban only works if the stores can spot the next version of the trick.
The real lesson here is not that a few bad apps slipped through. It is that the review process both stores rely on has a blind spot they have known about for years, and that blind spot is a server that can change what an app does after it has been approved. Apple says it suspended tens of thousands of apps over the past year for similar bait-and-switch tactics, which tells you how common this is. Until the stores can check what an app actually does after it leaves review, not just what it looked like on the day it was submitted, the safest assumption is that a free app with a cute premise and no obvious business model deserves a second look before it goes on your phone, and definitely before it goes on your kid's.
---------------
Author: Blake Taylor, New York News Desk