WIRED investigation finds network of 400+ apps and domains disguised as everyday AI tools that load hidden sexual deepfake generators; Apple removes 19 apps, Google removes most

A WIRED investigation, drawing on researchers at AI Forensics and Infoblox, describes a network of more than 400 linked domains and apps that look harmless (pet portraits, workout coaching) but load a hidden web interface for explicit deepfake images and video. According to the reporting, the apps decide what to show using server-side checks, including whether the visitor arrived via a Meta ad. 27 apps were live on Google Play in September with 350,000+ downloads. After WIRED asked questions, Apple removed 19 apps and Google removed most of the apps, including DiffAI (100,000+ downloads). The operator is described as apparently Chinese developers and a Hong Kong entity, KeLing Technology Limited. That attribution is hedged ("apparently") and no primary report or dataset is linked.

The main finding is a process failure: app store review checks what an app shows a reviewer, and these apps allegedly show something different to real users. Anyone responsible for platform trust and safety, ad policy or child protection should read this as evidence that review-time checks and ad screening can be gamed cheaply with disposable apps. Regulators already looking at nudify tools and AI-generated abuse material in ads gain a concrete, named example. The practical effect so far is limited: removals followed press enquiries, they cover one network, and there is no sign of a rule change or enforcement action against the operators.

"Hundreds of apps" and "400+" cover domains and apps combined, and only 27 Google Play apps are cited, so the scale of actual app store exposure is smaller than the headline suggests. Google's "most" removals is vague, and nothing independent confirms the operator identity or that this is a single organised network. The claims about tens of thousands of Meta ads and regulator investigations come from the reporting and researchers, with no primary documents linked. Apple's remark about suspending tens of thousands of apps is a general reassurance, not proof it is catching this tactic.

1. 01Whether the removed apps return under new names or developer accounts within weeks, and whether researchers find more of the 400+ domains still live on Google Play and the App Store.
2. 02Any formal response from Meta on the ads, or from regulators (Ofcom, the EU Commission, the US FTC or state attorneys general) naming this network or KeLing Technology Limited.
3. 03Concrete changes to Apple or Google review rules, such as server-side behaviour checks, tighter nudify-tool policies, or published takedown figures, rather than one-off removals.