Apple and Google Approved Hundreds of Innocent-Looking AI Apps That Secretly Unlocked Deepfake Porn Tools

An app called Viefur sold people about $4 worth of coins to dress their pets in human clothes. Under the right conditions, it could also load a hidden interface that turned uploaded photos into explicit sexual images and videos.

Viefur was one piece of a network of more than 400 connected apps and domains uncovered by WIRED. They posed as pet portrait makers, language tutors and AI workout coaches, and they got past app store review. Inside, templates carried labels like "bedroom rape" and "threatening knife." Apple, Google and Meta all say their rules forbid this. The money still moved through Apple Pay and Google Pay, and the customers still arrived through ads on Facebook and Instagram.

A switch on a server

Paul Bouchaud, lead researcher at the nonprofit AI Forensics, reverse engineered the code. Each time one of the apps is downloaded, it calls a server with details such as where the user came from, their language and a unique identifier. The server then decides whether to show the harmless version or the explicit one.

One trigger appears to be installing the app after clicking an associated ad on a Meta platform. The apps' websites host the hidden layer, showing a black screen while the URL changes to include the word "risk." Users who get the other version buy "diamonds" to generate images.

The operation was tied together by a single JavaScript bundle listing every domain and app in the network, with package details, encryption keys and Facebook ad trackers. Infoblox researcher Maël Le Touz identified almost 500 linked domains.

Disposable apps, for all ages

Researchers got there by following links from thousands of explicit deepfake video ads on Facebook and Instagram. WIRED has previously reported that hundreds of those ads contained AI-generated child sexual abuse material, including images of real children. Those ads reached tens of thousands of people and prompted regulator investigations.

Since the start of the year, Bouchaud has found tens of thousands of such ads linked to the network, bought under fake payer names like "Draftmondcreldbro Duhustepre" and run from pages with no followers. Meta says it took action against more than 10,000 ad accounts linked to the network's domains. Meta already has an uneasy record on child safety, including its own chatbot suggesting "Who is the child passenger?" under a mother's car video.

The network has been publishing apps for about a year, at times dozens a week. Twenty-seven were live on Google Play in September, with more than 350,000 downloads between them, and many were rated suitable for all ages. One of them, DiffAI, passed 100,000 Play Store downloads. A user review said it contained templates for creating child abuse material and did no age verification.

Google pulled DiffAI shortly before WIRED got in touch and had removed most of the apps beforehand. It did not respond to WIRED.

"So far it hasn't"

Apple removed 19 apps, including Viefur, after WIRED shared the domains. Spokesperson Adam Dema said nudification apps are "strictly prohibited" and put the failure on the developers: "We review every app before it's published, and these apps complied with our rules when we reviewed them." The developers, Dema said, later changed the website the app pulled content from and promoted it with pornographic ads on a third-party platform. Apple says it suspended tens of thousands of apps for this kind of bait and switch over the last year.

The trail leads to Chinese-language developers and a Hong Kong registered entity, KeLing Technology Limited, based on WIRED's review of the domains. They did not respond to requests for comment, and after being contacted appeared to erase public connections between KeLing and the tools.

Katie Paul, director of the Tech Transparency Project, wants tech companies to answer where the money from these apps goes and how the operators keep bypassing moderation.

Bouchaud describes an organized commercial operation, one operator behind hundreds of disposable apps, cloaked to pass review and pushed with Meta's ad machine. "They don't expect enforcement to catch up," Bouchaud said, "and so far it hasn't."

Some offers on this page may be paid placements or contain affiliate links.