{"id":401168,"date":"2026-11-02T22:52:42","date_gmt":"2026-11-02T22:52:42","guid":{"rendered":"https:\/\/bizscoreai.com\/blog\/hundreds-of-ai-apps-network-hiding-sexually-abusive-deepfake-tools\/"},"modified":"2026-11-02T22:52:43","modified_gmt":"2026-11-02T22:52:43","slug":"hundreds-of-ai-apps-network-hiding-sexually-abusive-deepfake-tools","status":"publish","type":"post","link":"https:\/\/bizscoreai.com\/blog\/hundreds-of-ai-apps-network-hiding-sexually-abusive-deepfake-tools\/","title":{"rendered":"Hundreds of AI apps were part of a network hiding sexually abusive deepfake tools"},"content":{"rendered":"

A WIRED investigation<\/a> said the network included more than 400 connected apps and websites presented as ordinary AI services, with some capable of conditionally loading explicit deepfake interfaces.<\/p>\n

What was confirmed<\/h2>\n

Apple removed 19 apps after WIRED shared its findings with the company. The removed apps included Viefur, an app presented as a tool for turning pet photos into \u201canthropomorphic portrait\u201d images.<\/p>\n

According to WIRED<\/a>, Apple said the apps complied with its rules when reviewed, then changed the websites they retrieved content from after approval. Apple described this as a bait-and-switch tactic and said it had suspended tens of thousands of apps for similar conduct over the previous year.<\/p>\n

Apple also updated its App Review Guidelines on October 16. The revised rules address AI-generated nonconsensual intimate imagery and hidden features. Apps must proactively prevent and remove such content, while developers can face removal from the App Store and developer program if they misrepresent an app during review, according to MLQ\u2019s summary of the investigation<\/a>.<\/p>\n

Other platform responses reported by MLQ<\/a> included Google removing most identified apps before being contacted. Meta, after receiving more than 400 domains from WIRED, said it identified over 3,000 associated ads and acted against 11,600 ad accounts, more than 4,700 business pages, 5,200 users and 15,000 pages.<\/p>\n

What the investigation alleged<\/h2>\n

WIRED<\/a> traced more than 400 connected domains and apps linked to Chinese-language developers and a Hong Kong registered entity called KeLing Technology Limited. That connection does not establish that every developer or operator was Chinese. KeLing did not respond to WIRED\u2019s requests for comment.<\/p>\n

The services were presented as pet portrait generators, language tutors and AI workout coaches. Under certain conditions, researchers found that the apps contacted a server with information including language, traffic source and a device identifier. The server then determined whether to show the advertised feature or an interface for generating explicit sexual images and videos from uploaded photographs.<\/p>\n

Researchers identified hidden templates depicting sexual violence and threats, including a scene involving a knife. Users paid in-app credits or \u201cdiamonds\u201d to generate content. Infoblox researcher Ma\u00ebl Le Touz told WIRED that he identified almost 500 linked domains through shared code and references.<\/p>\n

The network reportedly began appearing in late 2025 and, at one point, registered about 30 apps and websites per week. In September, 27 related apps were live on Google Play and had more than 350,000 collective downloads, based on research by Paul Bouchaud of the nonprofit AI Forensics. DiffAI exceeded 100,000 downloads before Google removed it, according to MLQ<\/a>.<\/p>\n

Why this affects business visibility<\/h2>\n

The case shows that an app\u2019s store description may not describe everything its remote server can display. Businesses distributing or promoting an app may wish to check its listing name, website, developer and current behavior.<\/p>\n

Their review covered 28 federal and state laws in California, New York, Texas and Utah. The authors found that most laws focus on prosecuting individual creators and distributors, while technologies, platforms and economic incentives that enable mass production remain largely unregulated.<\/p>\n

The report organizes the ecosystem into model, product deployment, distribution and human layers. App stores and search engines sit within the deployment layer, while social media and other public or private platforms support distribution. Business owners may wish to check where their information appears, who controls each listing and whether the description matches the current service.<\/p>\n

For owners checking AI search visibility, BizScoreAI<\/a> scores how visible a business listing is to AI search and shows what an AI agent found on the listing and website.<\/p>\n

What to do now<\/h2>\n
    \n
  1. Inventory official and third-party listings.<\/strong> Search for the company name, product names, domain names and developer names across app stores, business directories, social platforms and partner websites. Record each URL and the owner or distributor associated with it.<\/li>\n
  2. Check developer and distributor relationships.<\/strong> Determine who supplied the app, website, white-label service or listing. If the business only sold or distributed the product, document that role and compare it with the entities named in public records and the investigation.<\/li>\n
  3. Compare names, URLs and ownership data.<\/strong> Check that each listing uses the correct business name, website and current product description. Flag profiles that point to a removed app, outdated domain, mismatched developer or service that no longer matches the listing.<\/li>\n
  4. Preserve dated evidence.<\/strong> Save screenshots of each listing, including its description, developer information, website and visible product functions. Note the date and the platform so later changes can be documented.<\/li>\n
  5. Request corrections and record unresolved references.<\/strong> Ask the relevant platform or directory owner to correct or remove an inaccurate entry. Keep a record of the request, response and any reference that remains unresolved for follow-up.<\/li>\n<\/ol>\n

    What remains unknown<\/h2>\n

    Businesses should not treat a listing relationship as evidence that they knew about or participated in abusive activity.<\/p>\n

    Other questions also remain open. The source does not establish the precise trigger for every hidden interface, whether all 400 connected domains and apps behaved alike, or whether every removed app had reached users through Meta advertising.<\/p>\n

    For business owners, the useful conclusion is narrower: verify the relationship between the company, its app-store listings and the current live service. The network was large, the apparent functions could change after review, and businesses may wish to keep directory information accurate.<\/p>\n

    Sources and verification<\/h2>\n