Wired uncovered a network of 400+ apps hiding deepfake creation tools on Apple and Google stores, generating 350K downloads and exploiting users for profit.
Wired investigation uncovers deepfake app network
An investigation by Wired has uncovered a network of more than 400 interconnected applications that secretly included features for creating deepfake sexual content on Apple and Google app stores for a year. These apps, disguised as tools for generating animal portraits, language learning, or fitness coaching, were downloaded over 350,000 times, evading the verification processes of the tech giants and benefiting Chinese developers without oversight.Commercial scale of the network
The network identified by Wired represents a large-scale commercial operation. Each download generates advertising revenue and collects user data that can be resold. Paul Bouchaud, a principal researcher at AI Forensics, describes the system as an organized, commercially managed operation, with an operator behind hundreds of apps and disposable domains designed to pass the App Store review and distributed via tens of thousands of Meta advertisements under fake payer names.Technical deception used in apps
The mechanism relies on a refined technical deception. The apps display harmless content during examination by Apple and Google, but after approval, they secretly load a web interface allowing the generation of explicit sexual images. This tactic allows developers to bypass platform rules while monetizing traffic through advertisements. Meta had to take action against more than 11,600 advertising accounts linked to this network, revealing the scale of the underground advertising system.User data collection and targeting
Each installation triggers a server call that analyzes the user's location, language, and a unique identifier. These metadata constitute an economically valuable resource. The explicit version of the app is likely triggered by a download after clicking on a Meta ad, allowing operators to target users most likely to use the paid features. AndroidPure notes that this massive collection of personal data represents a significant financial asset for developers.Moderation challenges for platforms
The discovery of this network imposes unexpected moderation costs on the platforms. Apple removed 19 applications after Wired shared the details, while Google removed most of the apps, including DiffAI, which had over 100,000 downloads. Adam Dema, an Apple spokesperson, acknowledges that these applications met their rules during review but were later modified by developers after approval. This flaw highlights the economic limitations of current verification systems and threatens the reputation of the platforms.Centralized technical infrastructure
The technical infrastructure reveals a centralized organization. Maël Le Touz, a threat researcher at Infoblox, explains that the network contained a massive list of configurations for other domains, each with different encryption keys, executing the same code and referencing each other. The entity KeLing Technology Limited, registered in Hong Kong, appears at the center of this network, coordinating nearly 500 interconnected domains.Rapid growth and industrial strategy
The network's growth indicates an industrial strategy. Emerging in late 2025, the system expanded rapidly in spring 2026, adding about 30 new application-web site pairs per week. This production pace suggests a well-established technical infrastructure and dedicated human resources. Each new app represents an additional revenue stream, increasing entry points while reducing the risk of detection. In September 2026, 27 applications remained active on the Google Play Store.Chinese developers behind the network
The technical analysis traces the network back to Chinese developers. The source code contains Chinese comments, and promotional videos bear watermarks of Chinese video editing software. This geographical location complicates the application of Western regulations. The use of a Hong Kong entity as a legal facade allows developers to maintain distance from the actual operations, making legal action difficult. The model echoes other economic risks related to artificial intelligence identified recently.Exploitation of users and victims
Users download apps classified as appropriate for all ages, unaware they are accessing tools for creating non-consensual sexual images. People whose photos are used without permission suffer harassment, humiliation, and psychological trauma. The network offered scenes explicitly labeled as "rape in a room" or "threatening knife," revealing a systematic exploitation of sexual violence for profit.
