AI apps found hiding illicit deepfake features

An investigation by Wired and security researchers has uncovered a network of more than 400 applications and websites that masqueraded as benign tools while secretly hosting features to generate sexually abusive and violent deepfake content.

These platforms often appeared as mundane utilities, such as pet portrait generators, language tutors, and workout coaches. Researchers found that the apps utilized bait-and-switch tactics to bypass store review processes. By using server-side checks, the developers were able to trigger hidden, explicit interfaces based on specific criteria, including user location, device type, or the method by which a user reached the application, such as clicking on explicit advertisements.

The network is linked to Chinese-language developers, including a Hong Kong-registered entity identified as KeLing Technology Limited. Some of these apps had been active for up to a year and were capable of processing payments through Apple Pay and Google Pay.

Following the publication of the findings on Nov. 2, 2026, Apple removed 19 identified apps from its store. Meta, the parent company of Facebook and Instagram, reported taking action against 11,600 ad accounts and 15,000 pages associated with the promotion of these services.

The discovery follows an update to Apple’s App Review Guidelines on Oct. 16, 2026, which specifically addressed the generation of non-consensual intimate images via artificial intelligence. As the investigation continues, attention has turned to how major technology platforms will enforce policies against these deceptive practices and whether more rigorous server-side monitoring will be implemented.