news

Apple removes 19 apps after researchers map a 400-app network hiding deepfake generators

The explicit image and video tools were loaded from a server after install, so the app that passed review was not the app users got.

By Priya Shenoy · 3 November 2026

Apple removed 19 apps from the App Store, including a pet portrait tool called Viefur, after a WIRED investigation published on November 2, 2026 mapped a network of more than 400 connected apps and web domains that presented themselves as ordinary AI utilities and, for some users, loaded a hidden interface for generating sexual and violent imagery from uploaded photos. The research behind it came from the European nonprofit AI Forensics, which reached the network by following links in video ads running on Facebook and Instagram.

The generator sat on a server, not in the binary

The apps in the network were marketed as pet photo editors, language tutors and AI workout coaches, and on first launch that is roughly what they did. Researchers found that the behaviour changed depending on signals including location, language and device data, with one apparent trigger being installation after clicking an associated Meta advertisement. Under those conditions the app opened a web interface where users could buy digital currency and generate explicit images and video from photographs of real people. Some of the hidden tools shipped templates depicting sexual assault and physical threats. Payments, in at least some cases, ran through Apple Pay and Google Pay.

That structure is the whole story. Nothing in the submitted package had to contain a generation model, because the generation happened elsewhere and was switched on afterwards by whoever controlled the server.

What each platform says it did

Apple spokesperson Adam Dema said every app is reviewed before publication and that these complied with the rules at the time, with developers later changing the source of the content the apps pulled in and swapping approved material for pornography. Apple also says it has suspended tens of thousands of apps over the past year for comparable tactics and has recently tightened its rules covering nudification tools and bait-and-switch behaviour. Google had already removed most of the identified apps before being contacted, and one app in the network passed 100,000 downloads before it was pulled.

Meta's numbers are the largest on the board. The company says it banned Hong Kong registered KeLing Technology Limited from advertising in 2025 after the company ignored a cease and desist letter, and that it has since acted against 11,600 ad accounts and 5,200 users and blocked 209 apps tied to the scheme. Those figures cover advertising enforcement rather than app distribution, so they are not comparable to Apple's 19 or to Google's removals, and none of the three companies has published a count of how many generations the network served.

Attribution stops at a Hong Kong registration

WIRED linked the operation to Chinese-language developers and to KeLing Technology Limited through domain records, contact addresses and an administration login page referencing the name. The company did not respond, and after being contacted, public links between the entity and the deepfake tools were removed. In late September 2026, users of the hidden interface were told about a new model called Veira, about which nothing has been published: no weights, no provider, no capability claim that anyone outside the network can test.

Store review is a snapshot, not a measurement

The practical finding here is about measurement rather than moderation. An app review records what a binary did on one day under one set of conditions, which tells you very little about a product whose generation capability is fetched remotely and gated on signals the reviewer does not control. The same gap shows up further downstream, where OpenAI and Meta have told a US evidence-rules panel that no method reliably detects AI video, and in the volumes being counted after the fact, including the 6,310 AI-generated child abuse images the IWF assessed in six months. Similar ads and apps were still being published as the investigation closed. The EU's ban on nudification apps is reported to take effect in about a month, which will test whether a legal deadline moves faster than a server-side config change.

Sources: Digital Trends, International Business Times Australia.

Priya Shenoy: Tracks what AI video actually costs across the platforms that resell access to the same handful of models. Treats a pricing page as a claim, not a fact, until someone checks it.