Deepfake Apps Hid Behind 400+ Harmless Fronts as Apple Pulls 19

More than 400 deepfake apps and linked websites spent about a year in plain view, dressed up as pet photo editors, language tutors and AI workout coaches. Behind that front sat a hidden switch that could turn uploaded photos of real people into explicit sexual images and videos. A WIRED investigation published Monday mapped the network, and Apple removed 19 of the apps after the magazine shared its findings, according to 9to5Mac.

The scale is easiest to grasp through the figures reported so far.

The deepfake apps network in eight figures

• 400+: connected apps and domains WIRED tied to the same operation.
• Nearly 500: linked domains identified by a researcher at the security company Infoblox, according to IBTimes.
• About 30: new app websites being registered each week at one point, researchers said.
• 27: apps from the network found live on Google Play in September.
• 350,000+: combined downloads of those 27 Google Play apps.
• 19: apps Apple pulled after WIRED contacted it.
• 11,600: Meta ad accounts actioned, plus 15,000 pages, per IBTimes. (9to5Mac put the ad account count at more than 10,000.)
• About 1 year: how long the network appears to have been publishing apps.

How a pet clothing app hid a deepfake generator

One app named in the reporting, Viefur, presented itself as a way to dress up photos of pets in human clothes. Others claimed to teach languages or coach workouts. None of that was the real business.

The apps pulled their content from the web, which meant the operators could change what users saw without submitting a new version for review. According to IBTimes, the screen a person got depended on where they downloaded the app, the language set on the device and a unique identifier assigned to that device. One trigger appeared to be installing the app after tapping a deepfake ad on Facebook or Instagram.

Once unlocked, the hidden web interface offered dozens of pornographic photo and video templates. 9to5Mac, summarizing WIRED, said some depicted violent scenes, including sexual assault and threats with a knife. Users bought credits to generate images, and IBTimes reported that payments ran through Apple's and Google's own billing systems.

The research behind the findings came from AI Forensics, a European nonprofit, IBTimes reported. Its lead researcher, Paul Bouchaud, reverse engineered the apps and found a list of related domains and apps, along with encryption keys and Facebook advertising trackers. The group first spotted the operation in early September and linked it to Chinese language developers and a company registered in Hong Kong.

Apple's 19 removals and the October rule change

Apple's defense is that it approved something different from what users later saw. "We review every app before it's published, and these apps complied with our rules when we reviewed them," the company said in a statement quoted by 9to5Mac. "After approval, their developers changed the website the app pulls its content from, replacing what we approved with pornographic content, and promoted it through pornographic ads hosted on a third party platform."

That is exactly the gap Apple tried to close two weeks ago. Its App Review Guidelines, updated October 16, now name nonconsensual intimate imagery as a risk for AI content creation apps and warn that developers who fail to fix violations after notice may be treated as breaking the Developer Code of Conduct. A new rule reported by 9to5Mac bans hidden, dormant or undocumented features outright. We covered those changes in Apple's new App Store guidelines on nudify apps.

Rules, though, only bite when someone notices the switch. Some of these apps had passed review at Apple, Google and Meta, all three of which already prohibit harmful deepfake content.

15,000 pages: what Meta and Google did

Meta said it took action against 11,600 ad accounts and 15,000 pages tied to the network. "We have strict rules against promoting nudify apps," a Meta spokesperson said, according to IBTimes. Meta has previously sued a Hong Kong based operator over ads for nudify services.

Google had already removed most of the apps from Google Play before WIRED reached out, IBTimes reported. Google Play's policies ban AI generated nonconsensual sexual content and require generative AI app developers to block prohibited material.

30 new sites a week: why removals may not end it

A registration pace of roughly 30 new app websites a week suggests the operators can replace takedowns faster than reviewers find them. Researchers warned that related ads and apps have kept appearing since the reporting.

For parents and anyone sharing photos online, the practical lesson is simple. An app that does something very different from its store listing is a red flag, whatever its rating. Delete it, then file a report using our guide on how to report a scam in the US. If you already tapped one of these ads, our checklist for when you have clicked a bad link on your phone covers the next steps, and you can scan for leftovers with our guides for iPhone and Android. More coverage of app safety lives in our tech section.