The pet portrait app was a front. 400 more like it hid a deepfake factory

Viefur looked harmless. It was a pet portrait app: you uploaded a photo of your dog, spent some digital coins (about $4 bought 130 of them), and got back your dog as a little human in a suit, or on a beach, or in space. Apple approved it for the App Store.

For some users, Viefur was something else. Open it after tapping the right advert and the pet filters disappeared, replaced by a menu of templates for turning photos of real people into explicit images. Researchers who went through those templates found labels including "bedroom rape" and "threatening knife."

Viefur was one app in a network of more than 400 linked apps and websites, mapped by WIRED with researchers from AI Forensics and the DNS security firm Infoblox. Apple pulled Viefur and 18 others after reporters got in touch. Google had already taken down most of its listings by the time WIRED asked.

Two apps in one

The trick was simple and it worked on two of the most heavily policed software stores on the planet. According to WIRED's reporting, as summarized by Digital Trends and Dataconomy, each app phoned home after install. It sent the user's location, language, device identifier and how they found the app. A remote server then decided which version to show. App Store reviewers, checking the app from a test device, got the pet portraits. A user who arrived through the right Meta ad got the abuse tool.

Dataconomy reports that one apparent trigger was installing the app after clicking a Meta ad whose web address contained the word "risk." Because the explicit content was pulled from websites the developers controlled, they could change what the app showed long after Apple had signed off on it.

Apple's spokesperson Adam Dema said as much. According to Dataconomy, Apple said the removed apps followed its rules at review time, and the developers later changed the websites the apps loaded content from and promoted them through third-party porn ads. Apple said it had suspended tens of thousands of apps for this kind of bait-and-switch over the past year, and it rewrote its App Store guidelines in mid-October to restrict nudify tools and bait-and-switch apps.

Paul Bouchaud, lead researcher at AI Forensics, described the network as "an organized commercial operation" built on "hundreds of disposable apps and domains." His analysis puts the start of it near the end of 2025, with a sharp rise in spring 2026, when about 30 new nudify app websites were being registered every week. In September, 27 of these apps were live on Google Play. Between them they had more than 350,000 downloads, and many were rated as suitable for all ages.

One of them, DiffAI, was created in December 2025 and passed 100,000 downloads on Google Play before Google removed it. A user review quoted by Dataconomy said the app offered templates for child sexual abuse material and pornography "without age verification."

Follow the keys

Infoblox researcher Maël Le Touz found almost 500 linked domains. They shared code and referenced each other through encryption keys, which is how a scattered pile of pet apps and fitness coaches turned into one map. An admin login page for the explicit interface referred to Keling, and WIRED tied much of the network to a Hong Kong-registered company called KeLing Technology Limited. Le Touz pointed to Chinese-only hosting, Chinese comments in the code, and watermarks from Chinese-language video editing software in the explicit ad videos.

KeLing did not answer repeated requests for comment. Public links between the company and the deepfake tools started disappearing after it was contacted. One of the related sites, Veyra AI, quietly deleted a KeLing email address from its contact page.

Meta comes out of this looking like the shop window. The apps found their users through Facebook and Instagram ads, run under payer names such as "Draftmondcreldbro Duhustepre" and "Swaldmungsha Glasirdcroldshold," often on pages with zero followers. Meta's Katie Paul said the ads broke several of its policies, including rules on explicit depictions of minors. Meta had banned KeLing from advertising in 2025, after the company ignored a cease-and-desist letter. The ads kept running anyway.

Once WIRED handed over the 400-odd domains, Meta found more than 3,000 ads tied to them, about two thirds of which it had already removed. It then took action against 11,600 ad accounts, more than 4,700 business pages, 5,200 users and 15,000 pages, and blocked 209 apps from advertising.

Those numbers are meant to sound decisive. Read them the other way around: one company that Meta had already banned was able to stand up thousands of ad accounts and thousands of pages, with names that look like a cat walked across a keyboard, and nobody noticed until journalists brought a spreadsheet.

Some of the apps took payment through Apple Pay and Google Pay, according to Digital Trends. Both stores' review systems checked a pet filter and waved it through. What they never tested was the one thing the developers were counting on: what the app does a week later, for a different person, on a different phone.

Sources: WIRED, Dataconomy, Digital Trends.