Over 400 Apps Conceal Sexual Deepfake Tools Behind Pet Portrait Apps
More than 400 apps and web domains disguised tools for making sexual deepfakes as everyday products, according to a WIRED investigation published on 2 November 2026. The decoys included pet-portrait makers, language tutors and AI workout coaches. The network was traced with the nonprofit AI Forensics. According to WIRED, Apple removed 19 apps after it was contacted, and Google had already removed most of the apps the outlet found. The apps reportedly showed a harmless interface during store review and switched to a hidden one under certain conditions. For businesses, the lesson is that a store listing and a passed review do not show what an app will do later. Any AI tool that handles staff or customer photos needs a check of its data handling and a periodic review after updates.
In short
- WIRED's investigation, published 2 November 2026, traced more than 400 apps and domains that hid sexual deepfake tools.
- Apple removed 19 apps after WIRED contacted it, and Google had already removed most of the apps it found.
- Apple's guideline 2.5.19, dated 16 October 2026, bans hidden or undocumented features.
- A passed store review does not show what an app will do after its server settings change.
- Businesses of any size should list the AI apps staff use with work data and recheck that list regularly.
What happened
According to a WIRED investigation published on 2 November 2026, more than 400 connected apps and web domains presented themselves as ordinary consumer tools while holding a route to sexual deepfakes. The investigation said the apps were offered in both Apple's App Store and Google Play. The network was traced with the nonprofit AI Forensics. WIRED linked much of it to Chinese-language developers and to a Hong Kong company, KeLing Technology Limited, which WIRED reported had scrubbed its online presence after being contacted.
The mechanism is what makes the case hard to catch. According to AppleInsider's summary of the investigation, the apps contacted remote servers after installation and sent details such as the user's language, a referral source and a unique identifier. The server then decided whether to show the advertised feature or to load a separate website with explicit deepfake generators. One example named in the reporting was Viefur, a pet-portrait app that turned animal photos into humanlike characters.
How the platforms responded
The responses differed by company, and the reporting does not give a full picture of each one's enforcement.
| Company | What was reported |
|---|---|
| Apple | Removed 19 apps, including Viefur, after WIRED contacted it. Apple said the apps had complied with its rules when reviewed and that developers later changed the content the apps loaded. |
| Had removed most of the identified apps before WIRED contacted it, according to the reporting. | |
| Meta | Said it had taken action against more than 10,000 ad accounts linked to domains tied to the apps, according to 9to5Mac's report on the investigation. |
Why it matters for businesses that automate work
Many firms now let staff try small AI tools without a formal purchase. That habit is where this network did its work. A pet-photo app on a manager's phone looks like a low-risk download, yet it can hold a copy of every image the user uploads.
Apple has since tightened its rules. On 16 October 2026, Apple added guideline 2.5.19, which bans hidden, dormant or undocumented features and names code obfuscation as a way of hiding them. According to 9to5Mac, an app found hiding such features can be removed and its developer account terminated. The same update names nonconsensual intimate imagery, including AI-generated content, in guideline 1.2.
In Europe, lawmakers have moved too. According to eunews, the European Parliament and the Council of the European Union agreed an amendment to the EU AI Act that bans nudifier systems, and it is due to take effect on 2 December 2026.
What changes in practice for a business of any size
A five-person firm and a group with thousands of staff face the same basic question: which outside tools touch photos, documents or customer data? The answer is usually longer than the IT team expects. A practical review looks like this:
- List every AI app and browser tool that staff use with work files, customer photos or payment details, including tools installed on personal phones used for work.
- Ask each vendor where its processing runs, what data it keeps, and whether the app loads content from remote servers after installation.
- Do not treat a store badge or a passed review as evidence of what the app will do after an update.
- Where mobile device management is in place, restrict installs of unapproved AI apps on work devices.
- Set a reminder to recheck the list each quarter, because listings and server-side behaviour can change without notice.
What automation cannot do here
Automation can watch a list of approved tools, flag new installs and remind a named person to recheck a vendor. It cannot tell from a store page whether a server will switch on a hidden feature next month. A person still has to decide which tools are allowed and what data may go into them, and a one-time check gives limited comfort on its own.
What to watch next
Three things are worth following. The first is whether Google publishes its own removal list under a rule similar to Apple's, since the reporting does not say it has done so. The second is whether the EU ban takes effect on 2 December 2026 as reported. The third is any follow-up from WIRED or AI Forensics on the remaining apps and domains, and whether ad platforms keep removing the related ads.
Sources
How AiStaffo would automate this
AiStaffo would start by building a register of every AI app and browser tool that touches work files, photos or customer data, pulled from the company's device and account records. An automated workflow would then compare new installs and listing changes against that register and send an alert to a named owner. Each vendor request would go through a fixed checklist covering data handling and remote content, and the answers would be stored with the register. The owner still decides which tools are allowed and reviews any flagged app. Book a free automation audit.
Questions people ask
What did the WIRED investigation find?
Did Apple and Google remove the apps?
What is Apple's rule on hidden features?
Is there a law banning nudify apps in the EU?
How can a business check whether an AI app is safe to use?
Can automation prevent this kind of problem?
Book a free automation audit
Thirty minutes. We look at one process you run every week and tell you exactly what an AI worker would take off your desk, and what it would not.
