# A pet-portrait app was a front: 400+ disguised apps hid an AI deepfake abuse service

> Researchers traced a network of harmless-looking apps that switched to sexual deepfake tools for some users. Apple and Google pulled them after a year on their stores.

- URL: https://dev.devisdead.ai/news/a-pet-portrait-app-was-a-front-400-disguised-apps-hid-an-ai-deepfake-abuse-servi
- Published: 2026-11-02T13:02:07Z
- Author: DevIsDead Newsroom
- Section: Policy
- Tags: deepfakes, app stores, meta, trust and safety
- Originally reported by WIRED (https://www.wired.com/story/hundreds-of-mundane-ai-apps-are-hiding-abusive-deepfake-features/).

The app said it turned your cat into a cartoon. For the right user, it loaded something else entirely.

A [WIRED](https://www.wired.com/story/hundreds-of-mundane-ai-apps-are-hiding-abusive-deepfake-features/) investigation by Matt Burgess traces a network of more than 400 linked apps and domains that posed as ordinary services, including pet portraits, language lessons and AI fitness coaching, while hiding a tool for making sexually abusive deepfake images and videos from uploaded photos.

## How it worked

Researchers found the network by following links from thousands of explicit deepfake video ads on Facebook and Instagram, some of which contained AI-generated child sexual abuse material. Those ads pointed to apps in Apple's and Google's stores, with payments through Apple Pay and Google Pay.

When an app launched, it checked in with a server, sending details like language, location and a device identifier. The server then decided whether to show the harmless app or load the hidden explicit interface. Arriving from one of the Meta ads appears to be one trigger, according to Paul Bouchaud of the nonprofit AI Forensics, who reverse-engineered the code. A JavaScript bundle on the sites exposed the whole operation, and Infoblox researcher Maël Le Touz counted nearly 500 linked domains.

## The scale

The apps began appearing in late 2025 and peaked this spring at around 30 new ones a week. In September, 27 were live on Google Play, with more than 350,000 combined downloads and many rated for all ages. WIRED links the network to Chinese developers and a Hong Kong company, KeLing Technology Limited, which didn't respond but appeared to scrub its public links afterward.

Google had removed most of the apps before WIRED got in touch and didn't comment. Apple removed 19 after being contacted, and said the apps passed review and were changed afterward to load different content. Over the past year, Apple says, it has pulled tens of thousands of apps over that kind of bait-and-switch.

## Why it matters

App review checks what an app does on the day it's reviewed. Apps whose real behavior is decided by a server can change after that. Stores, ad platforms and payment providers each saw one piece of this operation, and none of them stopped it alone. The people who did were outside researchers and reporters.

**[Scoreboard](/scoreboard) update:** Humans +1. Researchers expose a hidden deepfake app network the platforms missed.

Stay undead.