Apps promoted for making pet portraits or offering other everyday AI services were part of a much larger operation, a WIRED investigation found. Under certain conditions, some could display a hidden web interface for generating explicit images and videos from uploaded photos.
The discovery raises questions about how apps can appear harmless during review and later expose users to very different features. Researchers described a network of hundreds of linked domains and apps, while Apple and Google removed many of the apps from their stores.
Everyday storefronts, hidden tools
Viefur was presented as a pet portrait app. Users could spend digital coins to turn pet photos into images of animals in human clothing and unusual settings. But the investigation found that the app was connected to a hidden layer for producing sexually abusive deepfake imagery.
The apps did not always show that content. Researchers said the software contacted a server when downloaded, sending information such as a user’s location, language, and a unique identifier. The server then determined whether the app should display its ordinary features or an explicit version.
Researchers did not identify a complete list of conditions that triggered the explicit interface. One apparent trigger was installing an app after following an associated advertisement on Meta’s platforms.
The hidden interface offered templates for sexual images and videos, including scenarios described as “bedroom rape” and “threatening knife.” Users could upload pictures of people to place them in those scenes. The interface also offered purchases of “diamonds” used to generate images.
A network linked by shared code
Researchers found clues to the network in the websites associated with the apps. Opening some sites produced a black screen, while the URL changed to include the word “risk.” Yet the sites hosted the explicit interface that could be loaded inside an app.
The websites’ JavaScript code contained a configuration list linking domains and apps, along with app package details, encryption keys, and Facebook advertising trackers. Maël Le Touz, a staff threat researcher at Infoblox, identified almost 500 linked domains. He said the sites ran the same code and referenced one another.
Researchers traced the network after examining links in thousands of video ads containing explicit deepfake material on Facebook and Instagram. The investigation says ads linked to deceptive apps in Apple and Google’s stores, where users could make payments using Apple and Google Pay.
The apps appeared to have been published for around a year, sometimes at a pace of dozens per week. Paul Bouchaud of the nonprofit AI Forensics found that around 30 nudify app websites were being registered each week at one point. The source reports that 27 were live on Google’s Play Store in September, with more than 350,000 downloads collectively.
Reviews, removals, and unanswered questions
One app, DiffAI, was created in December 2025 and had more than 100,000 Play Store downloads. A user review warned that it contained templates for creating CSAM and other pornographic material and did not perform age verification. DiffAI was removed shortly before WIRED contacted Google about the network.
Google did not respond to WIRED’s request for comment, though the company had removed the majority of the apps before being contacted. Apple removed 19 apps, including Viefur, after WIRED asked about the activity and shared related domains.
Apple spokesperson Adam Dema said the apps complied with the company’s rules when first reviewed. According to Dema, developers later changed the website supplying the apps’ content, replacing the approved material with pornography and promoting the apps through pornographic ads hosted on a third-party platform. Apple said it had suspended tens of thousands of apps for “bait-and-switch” tactics over the last year and updated its rules to further restrict nudify tools.
What the investigation says about accountability
The investigation links the apps and domains to Chinese developers and a Hong Kong registered entity called KeLing Technology Limited, based on a review of domains and how the services operated. Email addresses associated with the entity, apps, and related services did not respond to WIRED’s requests for comment. After WIRED contacted them, public connections between the entity and the deepfake tools appeared to be erased.
Researchers also found indicators pointing toward Chinese origins, including hosting and code with Chinese-language comments. The investigation says explicit videos in ads on Meta’s platforms carried watermarks from Chinese-language video editing software.
The central challenge described in the reporting is that an app’s visible purpose may not match its behavior after download. A benign listing and initial review can give way to content delivered from a website that developers control. That pattern makes it harder for users and platforms to judge an app from its store page alone, and it leaves enforcement responding to software that can shift after approval.
For Paul Bouchaud, the scale and coordination point to a commercial operation using many disposable apps and domains. His assessment was that enforcement had not kept pace. The removals show that platform action followed scrutiny, while the broader network uncovered by researchers illustrates how quickly the same approach could be spread across connected services.