According to an investigation by WIRED, hidden deepfake apps in the App Store and Google Play formed a network of over 400 interconnected domains and applications. They disguised themselves as pet photo editors, language teachers, or AI fitness trainers. However, under certain conditions, they loaded interfaces that created sexual and violent deepfakes from uploaded photos.
Hidden Deepfake Apps in the App Store and Google Play Bypassed Review
Among the scenes were depictions of bedroom rape and threatening knife scenarios, where a man holds a knife to a woman's throat. The apps employed a bait-and-switch tactic: during review, they displayed harmless content, but the server could activate hidden features. A trigger could be the installation after clicking an ad on Meta platforms. Users then downloaded pornographic templates and purchased credits to generate deepfakes. Payments were processed by Apple and Google. The network spread through thousands of video ads on Facebook and Instagram, some containing AI materials involving child sexual abuse.
Apple Removed 19 Apps, Meta Took Action Against Accounts
Apple stated that the apps complied with its rules during the review, but developers later changed the website from which they loaded content, replacing it with pornography. After sharing details with WIRED, Apple removed 19 apps. Google reportedly deleted most of the apps before contacting WIRED. Meta stated that it has strict rules against so-called nudify apps for stripping people, and according to 9to5mac, it took action against over 10,000 advertising accounts. ibtimes.com.au reports 11,600 accounts and 15,000 pages.
Who Was Behind the Network
The network was likely run by Chinese developers and the Hong Kong company KeLing Technology Limited, according to WIRED. The apps had been around for about a year, sometimes releasing dozens weekly. AI Forensics noticed the operations in early September; in September, there were 27 apps from the network on Google Play with over 350,000 downloads. Researcher Paul Bouchaud reconstructed the code and found a list of domains, encryption keys, and ad trackers. firstpost.com reports the emergence of domains at the end of 2025, peaking in spring, while ibtimes.com.au cites early September. According to firstpost.com, Meta banned KeLing Technology Limited from advertising in 2025 after failing to comply with a cease-and-desist order. After contacting WIRED, developers seemingly deleted public links between the company and the deepfake tools.