At first glance, the app Viefur looks like a standard tool for generating pet portraits. Users spend digital coins, costing about $4 for 130, to turn animal photos into anthropomorphic images. A hamster might end up wearing beach shorts and sunglasses in a pool, or a cat could appear in a Hawaiian shirt drinking from a coconut.
Behind this harmless front, the app functions as a gateway to creating sexually abusive deepfakes.
A WIRED investigation identified Viefur as part of a network comprising over 400 connected domains and applications. These services often present themselves as mundane utilities, such as language tutors or AI workout coaches. Under specific conditions, however, the apps load a hidden web interface. This allows users to generate explicit sexual images and videos from uploaded photos. Templates include scenarios labelled “bedroom rape” and “threatening knife,” depicting a man holding a blade to a woman’s neck.
Multiple researchers discovered the network while investigating links from thousands of video ads containing explicit deepfake content on Meta’s Facebook and Instagram. Recent reporting from WIRED noted that hundreds of these ads featured AI-generated child sexual abuse material, including images of real children and a member of a European royal family. The advertisements reached tens of thousands of people and have triggered investigations from regulators worldwide.
Each ad directed traffic to deceptive apps available in Apple and Google stores. Users could generate explicit imagery and make payments via Apple and Google Pay. The group behind these “nudify” apps has operated the network for approximately a year, sometimes releasing dozens of apps weekly. This activity persists despite Google, Apple, and Meta stating they enforce policies against harmful deepfake content.
WIRED analysis suggests the apps and domains are run by Chinese developers and a Hong Kong registered entity known as KeLing Technology Limited. Email addresses linked to the entity and related services did not respond to multiple requests for comment. Following contact, the entity appeared to erase public connections between KeLing Technology Limited and the deepfake tools.
“This is an organized, commercially run operation,” says Paul Bouchaud, a lead researcher at the nonprofit AI Forensics. “One operator behind hundreds of disposable apps and domains, cloaked to pass App Store review and pushed through tens of thousands of Meta ads under fake payer names. They don’t expect enforcement to catch up, and so far it hasn’t.”
Hidden Behavior
Downloading an app from the network may show the advertised feature, such as creating AI pet pictures. Behind the scenes, researchers found the apps determine whether to display benign content or load a web interface for explicit deepfakes.
“Each time the application is downloaded, there is a call to the server with some information, such as where the user is coming from, the language, some unique identifier, and then the server replies whether or not to show the explicit or the non-explicit version of it,” explains Bouchaud. He reverse engineered the apps’ and associated websites’ code. The team found no clear list of reasons why one user might see the explicit version, but one trigger appears to be downloading the app after clicking an associated ad on Meta’s platforms.
Websites linked to the apps reveal the network’s secrets and scale. Opening one of the sites typically shows an entirely black screen with no content. The only noticeable change is that the URL updates to include the word “risk.” These websites host the hidden explicit deepfake layer that loads within each app.
This web interface contains dozens of pornography deepfake video and image templates. Users can upload images of people to add to sexual scenes. The interface allows the purchase of “diamonds” to generate images and links to other social media accounts where users can contact the developers with questions or complaints.
Also hidden in the websites’ code are details about the entire network. A JavaScript bundle that can easily be unpicked contains a list of all the domains and apps created by the developers. This includes app package details, encryption keys, Facebook advertising trackers, and more.
“They contained this giant configuration list of other domains with different encryption keys,” says Maël Le Touz, a staff threat researcher at security firm Infoblox. He identified almost 500 linked domains. “They run the same code and they all reference one another.”
Bouchaud’s analysis of domain registration dates found the apps started appearing toward the end of 2025, with a spike during the spring of this year. At one point, around 30 nudify apps and websites were being registered each week. The researcher noted 27 were live on Google’s Play Store in September. Collectively, these apps had been downloaded more than 350,000 times. Many were rated suitable for all age groups, Bouchaud’s research says.
One of the most popular apps, called DiffAI, was created in December 2025 and has been downloaded more than 100,000 times from the Play Store. A user review on Google’s Play Store stated: “This app contains templates for creating CSAM and other types of pornographic material. It performs no age verification.”
DiffAI was removed from the Play Store shortly before WIRED contacted Google about the network. Google did not respond to WIRED’s request for comment, though it had removed the majority of the apps ahead of being contacted. Portions of the deepfake network were reported on by Danish journalists in September.
Similarly, Apple removed 19 apps from its App Store, including pet photo app Viefur, after WIRED asked the company about the activity and shared associated domains. “We designed the App Store to be a safe and trusted place for our users, and nudification apps and other pornographic content are strictly prohibited,” says Apple spokesperson Adam Dema.
“We review every app before it’s published, and these apps complied with our rules when we reviewed them,” Dema says. “After approval, their developers changed the website the app pulls its content from, replacing what we approved with pornographic content, and promoted it through pornographic ads hosted on a third-party platform.” The company says it has suspended tens of thousands of apps for using these “bait-and-switch” tactics over the last year and recently updated its app store rules to further restrict “nudify” tools.
Chinese Origins
Central to the “nudify” network appears to be a host of Chinese developers whose identities seem to have been intentionally hidden. “It’s using exclusive Chinese hosting, the code is written in Chinese and has a lot of comments in Chinese,” Le Touz says. He noted explicit videos in ads posted to Meta’s platforms promoting the apps contained watermarks from Chinese-language video editing software.
The apps and domains across the network have often used generic privacy policies, free email addresses from Gmail or Outlook, and obscure developer names as part of their alleged efforts to hide their connections. Ads for the apps posted on Meta’s platforms have also used apparently false names—such as Draftmondcreldbro Duhustepre and Swaldmungsha Glasirdcroldshold—and pages with no followers. Since the start of this year, Bouchaud’s research has found tens of thousands of explicit deepfake ads linked to the network—often using similar language in their advertising copy—on Meta’s platforms.
“These ads violate not just one, but several of Meta’s policies,” says Katie Paul, the director of the Tech Transparency Project. She first uncovered the ads showing deepfake explicit depictions of minors. “There is no question about what you are seeing, what the app is advertising,” she says. Paul says tech companies need to answer questions about where money generated from the apps goes and how those behind the nudification apps and services constantly seem to bypass their content moderation and safety systems.
KeLing Technology Limited appears to be a significant part of the operation. While the company’s website is little more than a shell, its name was listed as the contact details of the first website registered in the network. This website’s brand name also appeared as part of the contact details within the explicit deepfake template used in the apps. Bouchaud also identified an administration login page linked to the explicit deepfake interface that mentions “Keling.” Email addresses using the company’s domain appeared on at least one app that has been removed from app stores.
Towards the end of September, a notification sent to users of the explicit deepfake interface announced that a new AI model could be used. The model was called Veyra, with a tagline in the apps of “More real. More natural. More wild.” The homepage of a website called Veyra AI listed its contact email as a KeLing Technology address.
When WIRED contacted KeLing email addresses, plus some of those listed in apps privacy policies, we received no response. However, after WIRED reached out, someone renamed some of the associated online social media channels, removed KeLing email addresses from the AI Veyra website, and removed the KeLing Technology Limited address from the first registered website.
Meta says it banned KeLing Technology Limited from advertising in 2025 after it failed to “comply with a cease and desist letter.” (Meta declined to share the letter with WIRED citing legal reasons.) “We have strict rules against promoting nudify apps and work aggressively to keep this material off our services,” a Meta spokesperson says. Meta says that while KeLing Technology Limited has continued to try and advertise through other ways, it takes action against the ads when it becomes aware of them.
After WIRED shared the 400-plus domains with Meta, the spokesperson said they had shared more than 3,000 associated ads linked to them, two-thirds of which it had already removed from its systems. Meta later told WIRED it has taken action against 11,600 ad accounts, more than 4,700 business pages, 5,200 users, and 15,000 pages linked to the domains, blocking 209 apps from advertising on its platforms.
“The criminals behind them take increasingly deceptive steps to evade detection—hiding behind fake names and identities, running ads that look benign, and sometimes linking to Google’s and Apple’s app stores, with the ads’ true intent revealed only after a click,” the spokesperson says.
As WIRED finished reporting this story, similar ads and apps continued to be published on the tech platforms.
