At first glance, the mobile app Viefur markets itself as a whimsical pet‑portrait generator. Users can spend roughly $4 for 130 digital coins to transform a hamster into a beach‑clad model or dress a cat in a Hawaiian shirt. Beneath that veneer, however, the app is part of a far larger operation that creates sexually abusive deepfake images.
How the Network Operates
WIRED researchers traced a network of more than 400 interlinked domains and applications that masquerade as everyday services—language tutoring, AI workout coaching, and pet‑photo editing. When a user downloads one of these apps, the program contacts a remote server, sending data such as location, language and a unique identifier. The server then decides whether to present the advertised benign interface or to load a hidden web layer that offers explicit deepfake templates, including scenes titled “bedroom rape” and “threatening knife.”
These concealed interfaces host dozens of pornographic video and image templates. Users can upload personal photos, purchase virtual “diamonds,” and generate explicit content. The web pages often appear as a blank screen, with the URL appending the word “risk,” while a JavaScript bundle reveals a comprehensive list of all related domains, encryption keys and Facebook advertising trackers.
Platform Responses and Enforcement
The network surfaced after researchers followed thousands of video ads on Meta’s Facebook and Instagram that linked to the deceptive apps. Those ads, some of which displayed AI‑generated child sexual abuse material featuring real children and a European royal family member, reached tens of thousands of viewers and spurred regulatory inquiries.
Apple and Google’s app stores hosted the offending applications, allowing payments through Apple Pay and Google Pay. Despite stated policies that ban harmful deepfake content, the apps were published for roughly a year, with spikes of new releases—up to 30 “nudify” apps per week—and as many as 27 live on Google Play in September. Collectively, the apps amassed more than 350,000 downloads, many rated suitable for all ages.
One of the most downloaded tools, DiffAI, launched in December 2025 and exceeded 100,000 installations before being removed from Google Play after WIRED’s outreach. Apple later removed 19 apps, including Viefur, citing a “bait‑and‑switch” tactic where approved apps later fetched pornographic content from altered web sources. Apple spokesperson Adam Dema noted the company had already suspended tens of thousands of similar apps and updated its rules to further restrict “nudify” tools.
Origins and Attribution
Technical analysis points to Chinese developers and a Hong Kong‑registered entity, KeLing Technology Limited, as the core operators. The code is written in Chinese, hosted on Chinese servers, and contains watermarks from Chinese‑language video‑editing software. Email contacts linked to the entity failed to respond and later removed public ties to the deepfake services.
Security researcher Maël Le Touz of Infoblox identified nearly 500 linked domains, all sharing the same code base and referencing each other. Lead researcher Paul Bouchaud of AI Forensics described the operation as “organized, commercially run,” with disposable apps designed to evade app‑store reviews and to be promoted through Meta ads under fictitious payer names.
Katie Paul, director of the Tech Transparency Project, emphasized that the ads violate multiple Meta policies and called for answers on the flow of revenue and the repeated bypass of moderation systems. The investigation highlights a sophisticated, cross‑platform ecosystem that leverages innocuous app descriptions to distribute illegal sexual deepfakes, challenging the enforcement capabilities of major tech platforms.
Steve Lopez is a Senior Editorial Columnist and Health & Public Policy reporter for News Raise. Steve focuses on healthcare advancements, medical technologies, and public health policies.
