AI Apps Hid Sexual Deepfake Tools Behind Pet Portraits and Language Lessons

Cay Wild reports discovering an X page dedicated to AI-generated sexual depictions of her on 30 October. Her post describes the personal end of a technology whose commercial infrastructure is often less visible.

A WIRED investigation published on 2 November examines that infrastructure, identifying more than 400 connected apps and domains, many presenting ordinary services such as pet portraits and language tuition while selectively delivering sexual deepfake tools. The reporting does not connect those services to the depictions Wild describes.

The Server Decides Which App Users See

Viefur presents itself as a pet-portrait app, selling digital coins that turn animal photographs into stylised images. Researchers find that it belongs to a network whose apps can display a different service depending on information sent to a remote server.

Paul Bouchaud, a lead researcher at nonprofit AI Forensics, tells the publication that an app contacts the server with details including where the user comes from, their language and an identifier. The server then determines whether to show benign content or load the explicit interface.

The full selection criteria are unclear, although arriving through an associated Facebook or Instagram advertisement appears to be one trigger. Two people can therefore encounter different functionality behind the same ordinary-facing app.

The hidden interface lets users upload photographs of people for insertion into sexual images and videos. Purchases of digital currency fund generation, with the investigation describing payments through Apple and Google's systems alongside distribution through their app stores.

Shared Infrastructure Connects the Disguised Services

Researchers connect the services through code rather than branding. A JavaScript bundle contains configuration details referencing other domains and applications, exposing relationships between services that appear separate.

'They run the same code and they all reference one another', Maël Le Touz, a staff threat researcher at Infoblox, tells WIRED. His analysis identifies almost 500 linked domains, a different measure from the investigation's combined count of apps and domains.

The reported reach extends beyond a handful of listings. Research described in the investigation finds 27 apps live on Google Play in September, with more than 350,000 collective downloads. Those figures measure distribution, not the number of people depicted or harmed.

Meta advertisements bring users towards the apps, while app stores provide distribution and payment access. Researchers describe repeated advertising under apparently false names and services with generic policies and obscure developer identities.

The investigation also links parts of the operation to Hong Kong-registered KeLing Technology Limited through domain contacts, email addresses, and an administrative page. Contacted addresses do not respond to WIRED; after its approach, some associated sites and channels remove or change public connections to the company.

Platform Removals Do Not End the Reported Activity

Apple removed 19 apps, including Viefur, after the publication shared its findings. The company says the apps comply with its rules during review, but developers subsequently change the websites supplying their content, replacing approved material with pornography.

That explanation identifies a gap between reviewing an app and controlling what it later delivers. A benign interface at approval does not necessarily describe the remotely supplied content available afterwards.

Google's response follows a different timeline. WIRED reports that it removes most identified apps before being contacted, including one popular service, but does not respond to the outlet's request for comment.

Meta says it bans KeLing from advertising in 2025 and acts against attempts to return through other routes. After receiving the associated domains, it reports further enforcement, including blocking 209 apps from advertising—a restriction distinct from removing them from an app store.

Those actions target different parts of the same distribution system: listings, advertisements, and the accounts promoting them. Yet similar ads and apps were still appearing on the platforms at the time of the investigation.