 |
| AI-generated illustration of a smartphone with a magnifying glass over ordinary app icons and a warning shield, suggesting a phone safety check. |
A pet portrait app, a language tutor, a workout coach. On the surface, they looked like ordinary artificial intelligence utilities — the kind of small, harmless apps that fill every app store. According to a WIRED investigation published on 2 November 2026, many of them were something else entirely. Behind the friendly front, researchers found a network of more than 400 connected apps and websites that could secretly load tools for creating non-consensual sexual and violent deepfakes from photographs of real people.
That sentence is deliberately plain, because this is a story that needs care rather than sensation. The apps themselves are not the interesting part. What matters is how they got past the safety checks of the world's two largest app stores, what Apple, Google and Meta have done since, and what an ordinary phone owner should check today. This article sticks to what the investigation and the follow-up reporting actually established, separates confirmed actions from unconfirmed counts, and gives you a practical phone check that takes only a few minutes.
As an Amazon Associate, we earn from qualifying purchases.
Prices and savings can change. Check the retailer for the current price.
A note on language before we start: this article does not describe, link to, or reproduce any abusive tool, and it does not give instructions for creating deepfakes. It describes the deception in general terms only, because the point is protection, not replication.
What WIRED found
The investigation, built on research by the nonprofit AI Forensics and cybersecurity firm Infoblox, identified a network of more than 400 linked apps and web domains. The apps presented themselves as everyday AI tools: pet photo editors that turned animal pictures into human-like characters, language-learning apps, fitness coaches and similar utilities. One app named in the reporting was Viefur, a pet portrait app.
The key finding was not the disguise alone. It was the switch. According to the reporting, the apps contacted remote servers after installation and sent information including the user's language, referral source and a unique identifier. The server then decided which version of the app the user would see. Reviewers checking the app for store approval saw the harmless, advertised features. Some users, particularly those who arrived by tapping an advertisement on Facebook or Instagram, were instead shown a separate web interface with abusive image-generation tools.
That is why the story is often described as a bait-and-switch. App review, as Apple itself explained in its response, examines the app a developer submits. It cannot easily see a feature that a remote server switches on later, after approval. The apps, in Apple's words as reported, complied with App Store rules during their initial reviews and changed afterwards.
The scale figures in the reporting need the same care as the mechanism. The figure of more than 400 comes from WIRED's count of connected apps and domains, based on shared code, configurations and registration patterns traced by researchers. Apple has not confirmed that total. A separate, narrower figure is more firmly grounded: by September 2026, researchers had identified 27 related apps on Google Play with more than 350,000 combined downloads, including one app, DiffAI, with more than 100,000 installs. Those two numbers — the broad network count and the narrower store count — describe different things, and they should not be merged into a single claim.
Researchers traced the network to Chinese-language codebases, Chinese hosting services and a Hong Kong-registered entity identified as KeLing Technology Limited. According to Infoblox researcher Maël Le Touz, cited in the coverage, nearly 500 linked domains were mapped, sharing identical JavaScript configurations and cross-referenced encryption keys. AI Forensics lead researcher Paul Bouchaud tracked registrations back to late 2025, with as many as 30 domain and app combinations registered per week at the network's peak. Meta said it had previously banned KeLing Technology Limited in 2025 after issuing a cease-and-desist letter. These attributions come from the researchers and the companies involved; they are not court findings, and no individual developer has been named as convicted in the reporting so far.
What Apple, Google and Meta did
The three platform companies responded in different ways, and the differences are instructive.
Apple removed 19 apps after WIRED contacted the company and shared details of the network, including Viefur. Apple said the apps passed review and were changed afterwards, and it has not published a full list of the removed apps or their iPhone download counts. That gap matters for phone owners: if you cannot check a published list, you have to check your own phone instead, which is why the checklist below is based on behaviour and permissions rather than on a single list of names.
Google, according to the reporting, had removed the majority of the flagged titles before WIRED made direct inquiries, and acted against apps that broke its policies. The September figure of 27 apps and 350,000 downloads on Google Play therefore describes apps that were live for a period before removal, not apps that are necessarily still available today.
Meta's action was on the advertising side, which is where many users first met these apps. The company reported action against about 11,600 advertising accounts, roughly 4,700 business pages, and hundreds of apps blocked from its advertising platform, with later coverage citing wider enforcement figures. The point is not the exact tally, which varies between reports as enforcement continued. The point is that the network reached users substantially through paid advertisements on Facebook and Instagram, not only through people searching the app stores directly.
There is also a policy change that predates the investigation's publication. On 16 October 2026, Apple updated its App Review Guidelines to strengthen existing restrictions against non-consensual intimate imagery and against apps that conceal their functionality during review, as confirmed in Apple's own developer newsroom post cited in the coverage. That update did not prevent this network — much of which was already in place — but it shows the direction of the rules: hiding a feature from reviewers is itself now a clearer violation, not merely a detail.
None of this means the problem is solved. Removed apps can reappear under new names, new domains can be registered, and the same server-switch technique could be used by a different network. The investigation is best read as a warning about a method, not as a one-off clean-up.
Why the trick worked
App store review is a snapshot, not a continuous watch. A developer submits a version of an app, reviewers test that version, and the app is approved. If the app's real behaviour depends on instructions fetched from a server after installation, the approved snapshot and the live behaviour can diverge. That is the central weakness this network exploited.
Three other factors made it harder to catch. First, the disguise was plausible. Pet portraits, language lessons and workout plans are exactly the kind of low-stakes AI features that reviewers see every day, so nothing about the submitted version obviously demanded deeper investigation. Second, the network was distributed. Hundreds of domains and apps, registered over months, are harder to recognise as one operation than a single suspicious app. Third, the advertising funnel did part of the targeting. Users who tapped a deepfake advertisement were more likely to be shown the hidden interface than a reviewer testing the app in the ordinary way, so the abusive version was not equally visible to everyone.
Understanding that mechanism helps you understand what to look for. A suspicious app may not look suspicious in the store, and it may not behave suspiciously on first open. The warning signs appear in the pattern: an app that asks for more than its advertised job needs, that opens a web page instead of working inside the app, that pushes you to buy credits for image features it never advertised, or that arrived via an advertisement promising something very different from its store description.
How to check your phone today
You do not need any special tool for this check. Set aside five minutes and work through it calmly, especially if you have installed AI photo, pet portrait, language or fitness apps in the last year, or if you have tapped an AI photo advertisement on social media.
First, look at your installed apps with fresh eyes. On iPhone, open Settings, then General, then iPhone Storage, or simply scroll through your home screens and app library. On Android, open Settings, then Apps, then See all apps. Look for AI photo, portrait, language or workout apps you do not remember installing, apps whose icon or name does not match what they do, and apps you installed after tapping an advertisement rather than searching for them by name.
Second, check what each unfamiliar app can access. An app that edits pet photos does not need your contacts, your location, or access to your full photo library beyond the pictures you choose. An app that teaches a language does not need your camera roll. If an app's permissions are far wider than its advertised job, that is a reason to remove it, even if you cannot prove it belongs to any particular network.
Third, check for web behaviour. If an AI utility app opens a separate web page, asks you to upload photos of people through a browser window, or suddenly offers image features that were not in its store description, stop and remove it. Legitimate apps work inside the app; a hidden web interface is exactly the pattern described in the investigation.
Fourth, check subscriptions and purchases. On iPhone, go to Settings, tap your name, then Subscriptions. On Android, open the Play Store, tap your profile, then Payments and subscriptions. Look for subscriptions to apps you do not recognise, or for credit purchases inside photo apps you no longer use, and cancel anything you cannot explain. The reporting notes that users bought credits through Apple and Google payment systems for the hidden tools, so an unexplained credit purchase is a useful clue.
Fifth, remove and report. Delete any app you cannot account for, then report it through the store: on the App Store and Google Play, each app page has a report option. Reporting helps the stores spot a reappearing network faster than any single user can, and it creates a record if you later need to show that you acted promptly.
Sixth, protect your photos going forward. Be cautious about uploading photographs of yourself, your family or your friends to AI photo apps you have not verified, especially apps found through social media advertisements. Check the developer name, read recent reviews, and prefer apps from developers you can identify. If an app's developer website is little more than a shell page, or if its privacy policy does not clearly say what happens to uploaded photos, treat that as a reason not to install it.
If an image of you has been misused
This is the hardest part of the story, and it deserves a direct, practical answer. If you discover a fake sexual or threatening image of yourself online, do not try to investigate it yourself by engaging with the people sharing it. Save evidence privately — screenshots with the address and date visible, and the original links — without resharing the image. Report the content to the platform where it appears, using its non-consensual intimate image reporting route, and report the app or account that produced it to the relevant app store. If the image involves threats, harassment or extortion, contact your local police, who can advise on the laws that apply where you live. Laws and reporting routes differ by country, so this article does not invent a single hotline or legal claim that would not apply everywhere; your platform report and your local police are the two routes that exist in most places.
If someone you know is affected, the same calm approach helps: believe them, do not ask them to show you the image, help them save evidence and report it, and do not share it further, even to warn others, because sharing spreads the harm the image was designed to cause.
What is confirmed, what is reported, and what is still unclear
Confirmed on the public record: WIRED published the investigation on 2 November 2026; Apple removed 19 named-flagged apps after being contacted; Apple updated its App Review Guidelines on 16 October 2026; Google removed flagged titles, with most removed before direct inquiry according to the reporting; and Meta took large-scale advertising enforcement action against accounts and pages linked to the network.
Reported by WIRED and the researchers, but not independently confirmed by the platforms: the full network size of more than 400 apps and domains; the tracing to KeLing Technology Limited and related infrastructure; and the detailed server-switch mechanism as described by AI Forensics and Infoblox. Those findings are credible because they come from named researchers with mapped domains and shared code, but they remain research findings, not platform-confirmed totals.
Still unclear: whether any apps from this network remain live under new names; how many iPhone downloads the removed apps had, since Apple has not published that figure; whether any individual will face legal action; and whether the October guideline change, combined with this enforcement, will prevent a similar network. Those questions will only be answered by future platform transparency reports and, possibly, by law enforcement action.
Checklist: a safer phone in five minutes
- Review installed AI photo, portrait, language and fitness apps, especially ones found through advertisements.
- Remove apps you do not recognise, apps whose behaviour does not match their store description, and apps that open hidden web interfaces.
- Check permissions: a photo editor does not need contacts or location; a language app does not need your full photo library.
- Check subscriptions and in-app credit purchases, and cancel anything unexplained.
- Report removed apps through the App Store or Google Play.
- Before installing a new AI photo app, check the developer, the privacy policy, and recent reviews — and avoid shell developer websites.
- If an image of you is misused, save evidence privately, report it to the platform and the store, and contact local police if threats or harassment are involved. Do not reshare the image.
Bottom line
More than 400 apps and websites, disguised as everyday AI utilities, were able to hide abusive deepfake tools behind app store review by switching their behaviour on from a remote server after approval. Apple removed 19 apps, Google removed the majority of flagged titles, and Meta took action against thousands of advertising accounts — but the network's method, not just its apps, is the warning. Check your phone for unfamiliar AI utilities, strip back permissions that do not match the job, cancel unexplained subscriptions, and be sceptical of any AI photo app that arrives through a social media advertisement rather than through a developer you can identify. The stores caught this network after researchers mapped it. The next one will be caught faster if users check, remove and report.
Reference sources
- AppleInsider coverage of the WIRED investigation: https://appleinsider.com/articles/26/11/02/hundreds-of-ai-apps-were-part-of-a-network-hiding-sexually-abusive-deepfake-tools
- Silicon Report summary of the WIRED findings: https://www.siliconreport.com/wired-finds-over-400-domains-and-apps-hid-explicit-ai-features
- ETV Bharat coverage of the App Store and Play Store findings: https://www.etvbharat.com/en/technology/deepfake-apps-bypass-apple-google-meta-safety-checks-keling-technology-enn26110303728
- The Neuron daily AI roundup for 3 November 2026: https://www.theneuron.ai/digest/everything-that-happened-in-ai-today-tuesday-november-3-2026/
- Detailed account of the Apple App Store findings and Apple's response: https://www.switchingtomac.com/apple-app-store-deepfake-apps-hidden-features-wired/
Leave a public comment