An investigation by WIRED has revealed that hundreds of mundane mobile applications on Apple and Google app stores are masking a vast network dedicated to producing sexually abusive deepfake imagery. Apps such as Viefur present themselves as ordinary tools like language tutors or workout planners, but covertly load interfaces capable of generating explicit AI sexual content.
Hidden Behavior and Deceptive Tactics
Researchers uncovered the operation after tracing thousands of video ads on Meta platforms featuring explicit deepfakes, which directed users to deceptive listings on official app stores. According to Paul Bouchaud, a lead researcher at the nonprofit AI Forensics, the apps utilize server calls upon download to determine whether to display benign functions or load hidden pornography generation tools based on user location, language, and download source. The hidden web interfaces contain numerous video and image templates allowing users to upload personal photos and purchase credits using Apple Pay and Google Pay.
An analysis by Infoblox staff threat researcher Maël Le Touz revealed a configuration bundle listing nearly 500 connected domains sharing identical codebases and encryption keys. Bouchaud noted that the network began expanding rapidly in late 2025, with dozens of apps registered weekly. By September, 27 active applications on the Google Play Store had amassed over 350,000 collective downloads. One popular application named DiffAI, downloaded over 100,000 times, included templates for generating child sexual abuse material without age verification.
Corporate Response and Platform Action
Google removed DiffAI and the majority of the malicious apps before being contacted by WIRED. Apple removed 19 apps, including Viefur, after receiving inquiries from WIRED. Apple spokesperson Adam Dema stated that the applications complied with rules during initial reviews before developers utilized bait-and-switch tactics to alter the content source. Apple reported suspending tens of thousands of apps for similar violations over the past year.
The operation appears to originate from Chinese developers utilizing Chinese-language hosting, code comments, and video editing watermarks. A Hong Kong-registered entity named KeLing Technology Limited is central to the network, with its name appearing in early domain registrations and administrative login pages. Emails sent to KeLing and related addresses received no response, though public connections between the company and the deepfake tools were scrubbed following WIRED’s inquiries.
Meta stated it banned KeLing Technology Limited from advertising in 2025 following a cease and desist letter. After WIRED shared the domain list, Meta reported taking action against thousands of ad accounts, business pages, and user profiles while blocking hundreds of apps from advertising. Similar advertisements and applications continued to appear on major tech platforms as reporting concluded.
