Investigation Uncovers 400 AI Apps Hiding Abusive Deepfake Features

A massive network of approximately 400 mobile applications and websites has been identified as a front for generating sexually abusive deepfake content. According to a WIRED investigation, these tools often present themselves as benign services—such as pet portrait generators or fitness coaches—to bypass the security protocols of major app stores and advertising platforms.

How do these deceptive AI apps work?

These applications employ a "bait-and-switch" tactic to evade detection by human and automated reviewers. According to the investigation, an app like Viefur might appear to be a legitimate tool for creating anthropomorphic pet portraits. However, the software is designed to perform a server-side check upon download. By analyzing data such as the user's language, location, or the specific advertisement they clicked on Meta's platforms, the server decides whether to serve the benign interface or load a hidden web layer containing explicit content.

Researchers found that the hidden layer allows users to upload photos of individuals to be inserted into violent or sexually explicit AI-generated templates. This hidden interface is often hosted on URLs that include specific keywords like "risk," acting as a gateway to the prohibited content while remaining invisible to casual browsing or standard app store inspections.

Who is behind this deepfake network?

Evidence gathered by researchers suggests the operation is a highly organized, commercial enterprise. A review of web domains and operational patterns links the network to Chinese-language developers and a Hong Kong-registered entity known as KeLing Technology Limited, according to WIRED.

Security researchers, including Paul Bouchaud from the nonprofit AI Forensics, described the setup as a single operator managing hundreds of disposable domains and apps. This scale allows the creators to push through tens of thousands of advertisements on Meta's Facebook and Instagram platforms using fake payer names. While Meta stated it has banned KeLing Technology Limited for failing to comply with cease and desist orders, the network continues to attempt to reach users through various deceptive methods.

Why did major platforms fail to stop them?

Despite strict policies against harmful deepfake content, the network successfully bypassed the moderation systems of Apple, Google, and Meta for a significant period. Apple explained that while these apps initially comply with all rules during the submission process, the developers change the content source after the app is approved, replacing benign features with pornographic ones.

Similarly, the network utilized deceptive advertising. Many of the ads promoting these tools were published under fake identities and were often linked to explicit content that violated multiple platform policies. This allowed the apps to achieve hundreds of thousands of downloads and high ratings, as many users only encountered the harmful features after the initial installation.

What is the scale of the abuse?

Data from the investigation highlights a massive volume of activity. At certain peaks, developers were registering up to 30 new websites or apps per week. One specific app, DiffAI, reportedly reached over 100,000 downloads on the Google Play Store before being removed.

Researchers at security firm Infobлок identified nearly 500 linked domains that all shared similar code structures and encryption keys. This interconnectedness suggests that the network was designed for rapid expansion and resilience, allowing the operators to replace removed apps with new, similarly themed "disposable" versions almost immediately.

How can researchers analyze these trends?

For those studying the evolution of AI safety and the mechanics of deceptive software, understanding how these models are deployed is critical. While Grafy does not host or facilitate the creation of explicit content, researchers can use our tools to process and analyze technical documentation or security reports regarding these vulnerabilities.

For instance, if you are reviewing white papers or technical audits regarding deepfake detection or app store security protocols, Reader allows you to perform deep research over PDFs and academic papers, helping you synthesize complex information about AI safety and digital forensics.

Frequently asked questions

How do these apps hide their true purpose?

These apps use a technique where the server determines what content to show based on specific user triggers. While the app appears to be a harmless tool like a pet photo editor during the review process, it loads a hidden web interface for explicit content once it is in the hands of the target user.

What role did advertising platforms play in this network?

Meta's platforms, including Facebook and Instagram, were used to host tens of thousands of ads that led users to these deceptive apps. These ads often used fake names and bypassed moderation to promote the "nudify" services, effectively acting as the primary funnel for the network's user acquisition.

Have the app stores taken action against these developers?

Yes, both Apple and Google have removed numerous apps identified in the investigation. Apple noted that they have suspended tens of thousands of apps for using similar bait-and-switch tactics and have recently updated their rules to further restrict tools designed for unauthorized image manipulation.

---

Source: WIRED — AI — Hundreds of Mundane AI Apps Are Hiding Sexually Abusive Deepfake Features