Hidden Deepfake Apps Exposed: 400 Ordinary AI Apps Concealed Abusive Tools

More than 400 ordinary-looking artificial intelligence apps hid abusive deepfake tools behind innocent storefronts, according to a WIRED investigation published on Monday, November 2, 2026. The hidden deepfake apps posed as pet portrait editors, language tutors and AI workout coaches, but a remote switch could reveal a very different product: a web interface that generated sexually abusive and violent deepfakes from photographs of real people.

The findings, based on research by the nonprofit AI Forensics with domain analysis by Infoblox, describe a network of more than 400 linked apps and websites and roughly 500 domains. Apple removed 19 apps after WIRED shared its findings, and Google had already removed most of the apps in the network before WIRED contacted the company.

Key Points

• A WIRED investigation found more than 400 linked apps and websites, and about 500 linked domains, hiding abusive deepfake tools behind ordinary AI features.
• The apps checked a remote server after installation, which decided whether to show the advertised features or the explicit version.
• Twenty-seven apps were live on Google Play in September 2026 with more than 350,000 combined downloads, including DiffAI with over 100,000 downloads.
• Twenty apps were rated suitable for children on Google Play, according to the investigation.
• Apple removed 19 apps after being alerted, including the pet portrait app Viefur, and updated its App Review Guidelines on October 16, 2026.

What Happened

WIRED published its investigation on November 2, 2026, after working with AI Forensics and Infoblox. The researchers found apps and websites that presented themselves as harmless everyday tools. A pet portrait editor, a language tutor and an AI workout coach do not sound like products that need close scrutiny, and that ordinariness was the point.

According to the investigation, the apps checked a remote server after they were installed. That server decided which version of the product the user would see. Some users saw the advertised features. Others were routed to a hidden web interface that could generate sexually abusive and violent deepfakes from photographs of real people. One reported trigger for the hidden version was arriving at the app through a Meta advertisement.

The scale on Google Play alone was substantial. Twenty-seven apps were live on the store in September 2026, with more than 350,000 combined downloads. DiffAI had more than 100,000 downloads on its own, and 20 of the apps were rated as suitable for children. Apple removed 19 apps after WIRED shared its findings, including Viefur. Apple said the apps had complied with its rules at review and that developers later swapped approved content for pornography, and that it has suspended tens of thousands of apps over the past year for similar bait-and-switch tactics.

Hidden Deepfake Apps: How the Network Worked

The technical trick is not especially exotic, which is part of why it matters. Modern apps routinely fetch content and features from remote servers after installation, so a legitimate app can update its look or fix a bug without a full store update. The same mechanism can hide a product's real purpose until it is safely past review.

Researchers linked the domains behind the network to Hong Kong-registered KeLing Technology Limited, which did not respond to requests for comment. Advertising was a key distribution channel, and Meta said it had banned the linked entity from advertising in 2025. After WIRED shared the domains, Meta acted against 11,600 advertising accounts and 15,000 pages and blocked 209 apps from advertising, although similar ads and apps were still appearing as reporting ended.

In effect, an app that shows a pet portrait tool to a reviewer and a deepfake generator to a user is two apps sharing one listing. The store listing, screenshots and age rating all describe the first app. The harm comes from the second, so closing the gap requires checking not only what an app is at review, but what it becomes afterwards, including what its servers tell it to do.

What Apple, Google and Meta Said

Apple's response focused on the review gap. It removed 19 apps after WIRED shared its findings and, on October 16, 2026, updated its App Review Guidelines to explicitly cover AI-generated nonconsensual intimate imagery and hidden features, giving reviewers clearer grounds to reject apps that conceal their real function.

Google had removed most of the apps before WIRED contacted it, according to the investigation, which suggests its own detection caught much of the network, but only after a large audience had been reached. Meta's later action against thousands of accounts and pages shows how widely the network had spread across its advertising system. None of the companies has, in the reporting so far, explained in detail how the hidden versions evaded automated checks for so long, or whether users who downloaded the apps will be notified.

Why It Matters

The most immediate harm is to the people whose photographs could be turned into abusive deepfakes without their knowledge or consent. Nonconsensual intimate imagery can follow victims into their workplaces, families and communities, and is difficult to fully remove once images spread online. A network that packaged that capability inside apps rated suitable for children compounds the concern, because it placed a harmful tool within reach of young users and alongside products parents had no reason to suspect.

What Happens Next

Watch for fuller accounts from Apple, Google and Meta of how many users downloaded the apps, whether affected users will be notified, and what additional domains or accounts have been removed. Researchers will watch for the network's reappearance under new names and accounts.

For users: check what an app actually does after installation, be cautious about apps reached through advertisements, and report apps whose behaviour does not match their listing. Anyone who believes an image of them has been misused should preserve evidence and report the content.

Frequently Asked Questions

What did the WIRED investigation find?

A network of more than 400 linked apps and websites, and roughly 500 domains, posing as ordinary AI tools while hiding a web interface that could generate sexually abusive and violent deepfakes from photographs of real people.

How did the apps hide their real purpose?

They checked a remote server after installation, which decided whether to show the advertised features or the explicit version, so the store listing described a different product from the one some users received.

How many people downloaded the apps?

Twenty-seven apps were live on Google Play in September 2026 with more than 350,000 combined downloads, including DiffAI with over 100,000. Twenty apps were rated suitable for children.

What have Apple, Google and Meta done?

Apple removed 19 apps, including Viefur, and updated its guidelines on October 16, 2026. Google had removed most of the apps before WIRED contacted it. Meta acted against 11,600 advertising accounts and 15,000 pages and blocked 209 apps from advertising.

What should users do if they downloaded one of these apps?

Delete the app, check what permissions it held, and report suspicious behaviour to the app store. Anyone who believes an image of them has been misused should preserve evidence, report the content where it appears, and seek specialist support.

Related: Russian-linked AI deepfakes targeted Senate candidates and the ACLU warning on police AI traffic stops.