At first glance, the self-proclaimed “pet portrait” app Viefur appears to be just another AI slop generator. Using digital coins sold in the app—around $4 will buy 130 coins—pet photos can be turned into an “anthropomorphic portrait,” with the critter dressed in “human clothing” and inserted into bizarre scenes. Think a hamster wearing beach shorts, sunglasses, and lounging in a swimming pool or a Hawaiian shirt-wearing cat, drinking from a coconut.
All of this is cover for what appears to be the app’s true purpose: creating sexually abusive deepfake images.
A WIRED investigation found the app is part of a network of more than 400 connected domains and apps that, like Viefur, often claim to be everyday services—such as language tuition or AI workout coaches. When accessed under certain conditions, however, apps in the network stealthily load a web interface allowing the generation of explicit AI sexual images and videos using photos users upload. The apps include AI scenes such as “bedroom rape” and “threatening knife,” where a man holds a knife to a woman’s neck.
The network was discovered hiding in plain sight, by multiple researchers, after they investigated links from thousands of video ads containing explicit deepfake content that were published on Meta’s Facebook and Instagram. As WIRED has reported in recent months, hundreds of these ads contained AI generated child sexual abuse material, including images of real children and a member of a European royal family. The ads reached tens of thousands of people and have prompted investigations from regulators around the world.
In each case, the ads linked out to the deceptive apps in Apple and Google’s app stores—allowing people to generate explicit images and make payments using Apple and Google Pay. The network behind the nudify apps appears to have been publishing them for around a year, at times publishing dozens per week. This is despite Google, Apple, and Meta saying they enforce their policies that do not allow harmful deepfake content on their platforms.
The apps and domains investigated by WIRED appear to be run by Chinese developers and a Hong Kong registered entity called KeLing Technology Limited, according to a review of web domains and how the services operate. Email addresses linked to the entity, apps, and related services, did not respond to multiple requests for comment from WIRED, but after being contacted, they appeared to erase public connections between KeLing Technology Limited and the deepfake tools.
“This is an organized, commercially run operation: One operator behind hundreds of disposable apps and domains, cloaked to pass App Store review and pushed through tens of thousands of Meta ads under fake payer names,” says Paul Bouchaud, a lead researcher at the nonprofit AI Forensics, who investigated the network. “They don’t expect enforcement to catch up, and so far it hasn’t.”
Hidden Behavior
Download one of the apps in the deepfake network and you may see exactly what was advertised—such as an app to create AI pet pictures. But behind the scenes, researchers found, the apps are quietly making determinations about whether to show the benign content or load a web interface showing explicit deepfakes.
“Each time the application is downloaded, there is a call to the server with some information, such as where the user is coming from, the language, some unique identifier, and then the server replies whether or not to show the explicit or the non-explicit version of it,” explains Bouchaud, who reverse engineered the apps’ and associated websites’ code. They say there’s no clear list of reasons why one user may be shown the explicit version of an app, but one trigger appears to be downloading it after clicking an associated ad on Meta’s platforms.
Websites linked to the apps have revealed the network’s secrets and the scale that it operates on. Opening one of the apps’ websites will likely show an entirely black screen and no content. The only noticeable change is that the URL updates to include the word “risk.” But the websites host the hidden explicit deepfake layer that can be loaded in each app.
This web interface contains dozens of pornography deepfake video and image templates—with users able to upload images of people to be added to the sexual scenes. The interface allows the purchase of “diamonds” to generate images and links to other social media accounts where users can contact the developers with questions or complaints.
Also hidden in the websites’ code are details about the entire network. A JavaScript bundle that can easily be unpicked, researchers say, contains a list of all the domains and apps that have been created by the developers—including app package details, encryption keys, Facebook advertising trackers, and more.
“They contained this giant configuration list of other domains with different encryption keys,” says Maël Le Touz, a staff threat researcher at security firm Infoblox, who identified almost 500 linked domains. “They run the same code and they all reference one another.”
Bouchard’s analysis of when domains were registered found that the apps started to appear toward the end of 2025, with a spike during the spring of this year. At one point, around 30 nudify apps-websites were being registered each week, the researcher says, with 27 live on Google’s Play Store in September. These apps had been downloaded more than 350,000 times collectively and many were rated suitable for all age groups, Bouchard’s research says.
One of the most popular apps, called DiffAI, was created in December 2025 and has been downloaded more than 100,000 times from the Play Store. A user review on Google’s Play Store stated: “This app contains templates for creating CSAM and other types of pornographic material. It performs no age verification.”
DiffAI was removed from the Play Store shortly before WIRED contacted Google about the network. Google did not respond to WIRED’s request for comment, though it had removed the majority of the apps ahead of being contacted. (Portions of the deepfake network were reported on by Danish journalists in September.)
Similarly, Apple removed 19 apps from its App Store, including pet photo app Viefur, after WIRED asked the company about the activity and shared associated domains. “We designed the App Store to be a safe and trusted place for our users, and nudification apps and other pornographic content are strictly prohibited,” says Apple spokesperson Adam Dema.
“We review every app before it’s published, and these apps complied with our rules when we reviewed them,” Dema says. “After approval, their developers changed the website the app pulls its content from, replacing what we approved with pornographic content, and promoted it through pornographic ads hosted on a third-party platform.” The company says it has suspended tens of thousands of apps for using these “bait-and-switch” tactics over the last year and recently updated its app store rules to further restrict “nudify” tools.
Chinese Origins
Central to the “nudify” network appears to be a host of Chinese developers whose identities seem to have been intentionally hidden. “It’s using exclusive Chinese hosting, the code is written in Chinese and has a lot of comments in Chinese,” Le Touz says, noting explicit videos in ads posted to Meta’s platforms promoting the apps contained watermarks from Chinese-language video editing software.
The apps and domains across the network have often used generic privacy policies, free email addresses from Gmail or Outlook, and obscure developer names as part of their alleged efforts to hide their connections. Ads for the apps posted on Meta’s platforms have also used apparently false names—such as Draftmondcreldbro Duhustepre and Swaldmungsha Glasirdcroldshold—and pages with no followers. Since the start of this year, Bouchaud’s research has found tens of thousands of explicit deepfake ads linked to the network—often using similar language in their advertising copy—on Meta’s platforms.
“These ads violate not just one, but several of Meta’s policies,” says Katie Paul, the director of the Tech Transparency Project, who first uncovered the ads showing deepfake explicit depictions of minors. “There is no question about what you are seeing, what the app is advertising,” she says. Paul says tech companies need to answer questions about where money generated from the apps goes and how those behind the nudification apps and services constantly seem to bypass their content moderation and safety systems.
KeLing Technology Limited appears to be a significant part of the operation. While the company’s website is little more than a shell, its name was listed as the contact details of the first website registered in the network. This website’s brand name also appeared as part of the contact details within the explicit deepfake template that was used in the apps. Bouchaud also identified an administration login page linked to the explicit deepfake interface that mentions “Keling.” And email addresses using the company’s domain appeared on at least one app that have been removed from app stores.
Towards the end of September, a notification sent to users of the explicit deepfake interface announced that a new AI model could be used—the model was called Veyra, with a tagline in the apps of “More real. More natural. More wild.” The homepage of a website called Veyra AI listed its contact email as a KeLing Technology address.
When WIRED contacted KeLing email addresses, plus some of those listed in apps privacy policies, we received no response. However, after WIRED reached out, someone renamed some of the associated online social media channels, removed KeLing email addresses from the AI Veyra website, and removed the KeLing Technology Limited address from the first registered website.
Meta says it banned KeLing Technology Limited from advertising in 2025 after it failed to “comply with a cease and desist letter.” (Meta declined to share the letter with WIRED citing legal reasons.) “We have strict rules against promoting nudify apps and work aggressively to keep this material off our services,” a Meta spokesperson says. Meta says that while KeLing Technology Limited has continued to try and advertise through other ways, it takes action against the ads when it becomes aware of them.
After WIRED shared the 400-plus domains with Meta, the spokesperson said they had shared more than 3,000 associated ads linked to them, two-thirds of which it had already removed from its systems. Meta later told WIRED it has taken action against 11,600 ad accounts, more than 4,700 business pages, 5,200 users, and 15,000 pages linked to the domains, blocking 209 apps from advertising on its platforms.
“The criminals behind them take increasingly deceptive steps to evade detection—hiding behind fake names and identities, running ads that look benign, and sometimes linking to Google's and Apple's app stores, with the ads' true intent revealed only after a click,” the spokesperson says.
As WIRED finished reporting this story, similar ads and apps continued to be published on the tech platforms.
