Wired Investigation: 400+ Apps and Domains Hid Sexual Deepfake Tools, Passed Apple and Google Review

A Wired investigation has found a network of more than 400 connected domains and apps that looked like ordinary utilities and secretly unlocked tools for generating sexually explicit and violent deepfakes from uploaded photos. The apps were sold through Apple's App Store and Google Play.

They were not subtle once the hidden layer loaded. Templates carried labels like "bedroom rape" and "threatening knife," which shows a man holding a knife to a woman's neck.

How the apps got past review

Take Viefur. On the surface it is a pet portrait app. About $4 buys 130 in-app coins, and a hamster gets dressed in beach shorts.

Under certain conditions it loads a hidden web interface instead. Paul Bouchaud, a lead researcher at the nonprofit AI Forensics, reverse engineered the apps and found that each download triggers a server call carrying location, language and a unique identifier. The server then decides whether the user sees the harmless version or the explicit one.

One apparent trigger is downloading the app right after clicking a related ad on Facebook or Instagram. The hidden interface shows up as a blank black screen at a URL containing the word "risk." Users buy "diamonds" to generate content.

A single JavaScript bundle in the sites' code lists every domain and app in the network, along with package details, encryption keys and Facebook ad trackers. That is how researchers mapped it.

"This is an organized, commercially run operation: One operator behind hundreds of disposable apps and domains, cloaked to pass App Store review and pushed through tens of thousands of Meta ads under fake payer names," Bouchaud said.

Scale and timeline

Maël Le Touz, a staff threat researcher at Infoblox, identified almost 500 linked domains. They began appearing in late 2025 and spiked this spring, with roughly 30 new apps or websites registering weekly at the peak, according to Bouchaud. The network has been publishing for about a year, at times dozens of apps per week.

As of September, 27 of the apps were still live on Google Play with combined downloads above 350,000, Bouchaud's research found. Many carried ratings suggesting they were suitable for all ages.

Bouchaud also found tens of thousands of ads tied to the network since the start of the year. They were bought under fake payer names such as "Draftmondcreldbro Duhustepre" and run from pages with no followers.

The ad trail

Researchers found the network by following links from thousands of explicit deepfake video ads on Facebook and Instagram. Wired has previously reported that hundreds of ads in that wave contained AI-generated child sexual abuse material, including images of real children and a member of a European royal family. Those ads reached tens of thousands of people and prompted regulator investigations in multiple countries.

Meta said it has taken action against more than 10,000 ad accounts linked to domains associated with the apps. Apple removed 19 of the apps, including Viefur, after Wired shared the list of domains.

Who is behind it

Wired's review of web domains and how the services operate points to Chinese developers and a Hong Kong-registered entity called KeLing Technology Limited. That link comes from Wired's analysis and is not confirmed by the company.

Email addresses tied to the entity, the apps and related services did not respond to Wired's requests for comment. After being contacted, they appeared to erase public connections between KeLing Technology Limited and the deepfake tools.

What the platforms say

Apple, Google and Meta each say their policies prohibit harmful deepfake content and that they enforce those rules. The network's year-long run, and the 27 apps still on Google Play in September, sit awkwardly against that.

Apple spokesperson Adam Dema said nudification apps are "strictly prohibited" and that "these apps complied with our rules when we reviewed them." He said the developers later changed the website the app pulled content from and promoted it with pornographic ads on a third-party platform. Apple says it has suspended tens of thousands of apps over the past year for this kind of bait and switch.

The apps worked by showing reviewers something clean. Review that only sees what the developer chooses to show is a design problem, not a one-off miss. Payments also flowed through Apple Pay and Google Pay, which means the platforms processed the transactions.

Commentary site Dissenter argues that Apple and Google moved quickly against American conservatives while missing 400-plus foreign-linked apps. That is its characterization, and the investigation itself makes no such comparison. The documented fact is narrower: the platforms' stated bans did not stop a coordinated operation from running for about a year.

What is still open

Katie Paul, director of the Tech Transparency Project, wants tech companies to answer where the money from these apps goes and how the operators keep bypassing moderation. KeLing Technology Limited has not answered questions about the network, and its public footprint appears to have been scrubbed since Wired reached out.