One operator, hundreds of disposable fronts
A WIRED investigation published on 2 November found a network of more than 400 connected apps and domains that present themselves as ordinary services — AI pet photos, language tuition, workout coaching — while concealing tools that generate sexually explicit images and video from photos a user uploads. Some of the hidden interfaces advertise scenes depicting rape or a knife held to a woman’s neck.
The cloaking is deliberate. Researchers told WIRED the apps call a server when they are downloaded, passing details such as the user’s location, language and device identifiers, and the server decides whether to show the advertised content or load the deepfake interface instead. That is what allowed them through app review.
“This is an organized, commercially run operation: One operator behind hundreds of disposable apps and domains, cloaked to pass App Store review and pushed through tens of thousands of Meta ads under fake payer names,” said Paul Bouchaud, a lead researcher at the nonprofit AI Forensics, who investigated the network. “They don’t expect enforcement to catch up, and so far it hasn’t.”
The scale, and who removed what
Maël Le Touz, a staff threat researcher at the security firm Infoblox, identified almost 500 linked domains. “They run the same code and they all reference one another,” he told WIRED. Registrations began towards the end of 2025 and spiked in the spring; at one point around 30 of the apps and websites were being registered each week. Twenty-seven were live on Google’s Play Store in September, collectively downloaded more than 350,000 times, and many were rated as suitable for all ages.
One of the most popular, DiffAI, was created in December 2025 and downloaded more than 100,000 times from the Play Store. A user review on the listing said the app contained templates for creating child sexual abuse material and performed no age verification. Google removed it shortly before WIRED made contact, and had removed most of the network’s apps before being asked about it. Google did not respond to WIRED’s request for comment.
Apple removed 19 apps after WIRED shared the associated domains, including a pet photo app called Viefur. “We review every app before it’s published, and these apps complied with our rules when we reviewed them,” Apple spokesperson Adam Dema said. “After approval, their developers changed the website the app pulls its content from, replacing what we approved with pornographic content.” Apple says it has suspended tens of thousands of apps for such bait-and-switch tactics over the past year.
Meta, whose Facebook and Instagram ads led researchers to the network in the first place, said it had taken action against 11,600 ad accounts, more than 4,700 business pages, 5,200 users and 15,000 pages linked to the domains, and blocked 209 of the apps from advertising on its platforms.
Who is behind it
The apps and domains appear to be run by Chinese developers and a Hong Kong registered entity called KeLing Technology Limited, according to WIRED’s review of the domains and how the services operate. Email addresses linked to the entity did not respond to repeated requests for comment, and after being contacted, public connections between the company and the deepfake tools appeared to be erased. Payments ran through Apple and Google Pay.
What to watch
Portions of the network were reported by Danish journalists in September, and the ads that led to it have already prompted regulatory investigations in several countries. WIRED says that as it finished reporting, similar ads and apps were still being published on the same platforms — which makes the test of this round of enforcement whether the next 400 domains appear.
