What appears to be a harmless AI 'pet portrait' app, **Viefur**, is merely a facade for a much darker operation. Users pay digital coins to transform pet photos into anthropomorphic images, but this benign front conceals the app's real intent: the creation of sexually abusive deepfake imagery. A recent investigation by WIRED has uncovered that **Viefur** is part of an extensive network comprising over 400 interconnected domains and applications. These apps, often masquerading as everyday services such as language tutors or AI workout coaches, secretly load a web interface under specific conditions, enabling the generation of explicit AI sexual images and videos using uploaded user photos. Disturbingly, these interfaces include templates for scenes depicting 'bedroom rape' and 'threatening knife' scenarios. ## Unveiling the Hidden Network The deepfake network was initially discovered by multiple researchers investigating thousands of explicit deepfake video ads published on **Meta**'s **Facebook** and **Instagram**. As previously reported by WIRED, many of these ads featured AI-generated child sexual abuse material, some even depicting real children and a member of a European royal family. These ads reached a significant audience and have prompted global regulatory investigations. Each ad linked directly to these deceptive apps available on **Apple** and **Google**'s app stores, allowing users to generate explicit images and facilitate payments via **Apple Pay** and **Google Pay**. The network behind these 'nudify' apps has been active for approximately a year, at times releasing dozens of new apps weekly, despite explicit policies from **Google**, **Apple**, and **Meta** against harmful deepfake content. Further investigation suggests that the apps and domains are operated by Chinese developers and a Hong Kong-registered entity known as **KeLing Technology Limited**. While email addresses associated with **KeLing Technology Limited** did not respond to inquiries, public connections between the entity and the deepfake tools were reportedly erased after contact. "This is an organized, commercially run operation: One operator behind hundreds of disposable apps and domains, cloaked to pass App Store review and pushed through tens of thousands of Meta ads under fake payer names," states **Paul Bouchaud**, a lead researcher at the nonprofit **AI Forensics**, who extensively investigated the network. "They don't expect enforcement to catch up, and so far it hasn't." ## Covert Operations and Hidden Behavior Upon downloading an app from this deepfake network, users might initially see the advertised benign content, such as AI pet picture generation. However, researchers discovered that these apps covertly determine whether to display the innocent content or load the explicit deepfake web interface. "Each time the application is downloaded, there is a call to the server with some information, such as where the user is coming from, the language, some unique identifier, and then the server replies whether or not to show the explicit or the non-explicit version of it," explains Bouchaud, who reverse-engineered the apps' code. While the exact triggers for displaying explicit content remain unclear, downloading the app after clicking an associated ad on **Meta**'s platforms appears to be a key factor. Websites linked to these apps often display a black screen with the URL updating to include the word "risk." These sites host the hidden explicit deepfake layer that can be loaded within each app. This web interface offers dozens of pornography deepfake video and image templates, allowing users to upload images of individuals to be inserted into sexual scenes. The interface also facilitates the purchase of "diamonds" for image generation and provides links to social media accounts for developer contact. Crucially, the websites' code contains a JavaScript bundle that, when unpicked, reveals a comprehensive list of all domains and apps created by the developers. This includes app package details, encryption keys, and **Facebook** advertising trackers. "They contained this giant configuration list of other domains with different encryption keys," says **Maël Le Touz**, a staff threat researcher at security firm **Infoblox**, who identified nearly 500 linked domains. "They run the same code and they all reference one another." Bouchaud's analysis of domain registration dates indicates that these apps began appearing in late 2022, with a significant surge in spring 2023. At one point, approximately 30 'nudify' apps and websites were being registered weekly. In September 2023, 27 such apps were live on **Google**'s **Play Store**, collectively downloaded over 350,000 times and often rated as suitable for all age groups. One popular app, **DiffAI**, created in December 2022, amassed over 100,000 downloads from the **Play Store**. A user review explicitly stated, "This app contains templates for creating CSAM and other types of pornographic material. It performs no age verification." **DiffAI** was removed from the **Play Store** shortly before WIRED contacted **Google** about the network. While **Google** did not respond to WIRED's request for comment, it had removed most of the apps prior to being contacted. Danish journalists had previously reported on parts of this deepfake network in September. Similarly, **Apple** removed 19 apps from its **App Store**, including **Viefur**, after WIRED brought the activity to their attention. "We designed the App Store to be a safe and trusted place for our users, and nudification apps and other pornographic content are strictly prohibited," stated **Apple** spokesperson **Adam Dema**. **Dema** added, "We review every app before it's published, and these apps complied with our rules when we reviewed them. After approval, their developers changed the website the app pulls its content from, replacing what we approved with pornographic content, and promoted it through pornographic ads hosted on a third-party platform." **Apple** claims to have suspended tens of thousands of apps for similar "bait-and-switch" tactics over the past year and recently updated its app store rules to further restrict "nudify" tools. ## Tracing the Chinese Origins The 'nudify' network appears to be primarily driven by a group of Chinese developers who have actively concealed their identities. "It's using exclusive Chinese hosting, the code is written in Chinese and has a lot of comments in Chinese," notes **Le Touz**, observing that explicit video ads promoting the apps on **Meta**'s platforms contained watermarks from Chinese-language video editing software. Across the network, apps and domains frequently employed generic privacy policies, free email addresses from **Gmail** or **Outlook**, and obscure developer names in an apparent effort to hide their connections. Ads on **Meta**'s platforms also used seemingly false names, such as **Draftmondcreldbro Duhustepre** and **Swaldmungsha Glasirdcroldshold**, and pages with no followers. Since the beginning of 2023, Bouchaud's research has identified tens of thousands of explicit deepfake ads linked to this network on **Meta**'s platforms, often using similar advertising language. "These ads violate not just one, but several of Meta's policies," asserts **Katie Paul**, director of the **Tech Transparency Project**, who initially uncovered ads depicting deepfake explicit imagery of minors. "There is no question about what you are seeing, what the app is advertising." Paul emphasizes the need for tech companies to address the financial flow generated by these apps and explain how the operators consistently circumvent their content moderation and safety measures.