A WIRED investigation published on 2 November 2026 mapped a network of more than 400 connected apps and domains that posed as ordinary artificial intelligence tools — pet photo editors, language tutors and workout coaches — and that, under certain conditions, loaded a hidden interface for generating deepfakes — non-consensual intimate images of real people. This is reported here as CONFIRMED as an account of the investigation, with authorship attributions handled with the caution noted below.
How the trick worked
The central mechanism, according to the researchers, was a server-side switch after installation: the app contacted a remote server, sent data such as language, referral source and a unique identifier, and the server decided whether to show the advertised feature or the hidden interface. That helps explain how the apps passed initial store review and only later displayed prohibited content. Video ads on Facebook and Instagram reportedly directed users to the store listings.
The research was carried out by the nonprofit AI Forensics and the cybersecurity firm Infoblox. Infoblox researcher Maël Le Touz mapped almost 500 linked domains, with identical JavaScript configurations and cross-referenced encryption keys. AI Forensics researcher Paul Bouchaud placed the first registrations in late 2025, peaking at about 30 domain and app combinations per week. In September 2026, 27 related apps were on Google Play, with more than 350,000 combined downloads; one of them, DiffAI, had passed 100,000 installs.
What Apple, Google and Meta did
The platforms reacted at different speeds. Google had already removed most of the flagged titles before WIRED contacted it and, according to the report, did not respond to a request for comment. Apple removed 19 apps, including Viefur, after WIRED shared the details. Spokesperson Adam Dema said the apps complied with the rules at review time and that developers later changed the remote websites feeding their content. Apple also said it had suspended tens of thousands of apps over the past year for similar bait-and-switch tactics and, on 16 October, updated its guidelines to address AI-generated non-consensual intimate imagery and hidden features explicitly.
Meta said it had already banned the Hong Kong-registered entity named in the investigation, KeLing Technology Limited, in 2025 after a cease-and-desist letter. After receiving the researchers' dossier, the company said it acted against 11,600 ad accounts and about 4,700 business pages, and blocked 209 apps from its advertising platform. KeLing did not respond to requests for comment, and the technical links reported do not by themselves establish who controlled the whole network. WIRED also reported that similar ads and apps were still appearing as reporting concluded — a sign that removal alone does not end the problem.
Image credit: App Store icon, Apple (developer.apple.com).
Sources: AppleInsider; Silicon Report; RIX News, all reporting the WIRED investigation published on 2 November 2026.
Transparency: this article was produced with the help of artificial intelligence, based on cross-checking public posts and the internet sources cited below. Check the original sources for full details.
Muse
.webp)
