Wired: 400+ Cloaked AI Apps Hid Deepfake Tools; Apple Pulls 19
TL;DR
- Wired traced a network of more than 400 cloaked apps and roughly 500 linked domains that passed App Store and Google Play review as pet-photo and workout tools before serving deepfake generators.
- Apple removed 19 apps including the pet portrait app Viefur, while Meta said it acted on 11,600 ad accounts and 15,000 pages and blocked 209 apps from advertising.
- Researchers at AI Forensics and Infoblox tied the operation to KeLing Technology Limited, a Hong Kong-registered entity that did not respond to requests for comment.
Wired has published an investigation tracing a network of more than 400 cloaked apps and roughly 500 linked domains that passed App Store and Google Play review as pet-photo editors, language tutors and workout coaches, then loaded a hidden interface for generating sexually abusive deepfake images and video. Apple removed 19 apps after Wired shared its findings, including a pet portrait tool called Viefur that sold 130 coins for $4. Meta told the magazine it had taken action against 11,600 ad accounts and 15,000 pages tied to the operation and blocked 209 apps from advertising on its platforms.
The cloak is server-side. "This is an organized, commercially run operation: One operator behind hundreds of disposable apps and domains, cloaked to pass App Store review and pushed through tens of thousands of Meta ads under fake payer names," Paul Bouchaud, lead researcher at the nonprofit AI Forensics, told Wired. Each install calls back to a server that decides which build to serve; tapping a Meta ad for the deepfake variant is one of the triggers that flips the app from benign to explicit.
Scale built up out of sight. The apps began appearing in late 2025 and at peak roughly 30 new app-and-website pairs were registering per week, Bouchaud's domain review found. In September, 27 live apps on Google Play had more than 350,000 downloads combined, many carrying all-ages ratings. Infoblox threat researcher Maël Le Touz traced the roughly 500 interconnected domains to KeLing Technology Limited, a Hong Kong-registered entity. KeLing did not respond to requests for comment.
Apple's position, through spokesperson Adam Dema, is that submitted applications complied with storefront policies during initial review and that developers later changed the websites supplying their content, replacing approved material with pornography. The company updated its App Review Guidelines on October 16 to explicitly cover AI-generated nonconsensual intimate imagery and hidden features. It is the fourth significant piece of Apple governance news we have logged in roughly a week.
Shared on Bluesky by 1 AI expert
-
NEW: I recently reported how Meta ran hundreds of ads containing AI-generated child sexual abuse. Links in those ads and other nudify ads, led us to a network of more than 400 apps disguising themselves as everyday AI …
View on Bluesky →
Originally reported by wired.com
Read the original article →Original headline: Wired Investigation: 400+ Apps Run Covert Deepfake Network Across Apple and Meta Stores