Hidden network of 400+ 'cute' apps secretly generated abusive sexual deepfakes
A Hong Kong-linked operation disguised pet-photo and tutoring apps as harmless, then quietly served tools to make non-consensual sexual deepfakes via Apple, Google and Meta.
What happened: A WIRED investigation, working with independent researchers, uncovered a network of more than 400 connected apps and websites that pose as ordinary services - pet-portrait generators, language tutors, workout coaches. Behind that friendly front, many quietly load a hidden tool that turns uploaded photos into explicit sexual deepfakes, including scenes depicting rape and a man holding a knife to a woman's neck. The network traces to Chinese developers and a Hong Kong-registered company, KeLing Technology Limited, and appears to have been operating for about a year, at times launching dozens of new apps weekly.
Why it matters: These aren't obscure dark-web tools. The apps lived in Apple's App Store and Google Play, were promoted through tens of thousands of Facebook and Instagram ads, and took payment through Apple Pay and Google Pay, systems people already trust. Some ads and templates involved real children; one Play Store reviewer flagged an app as generating child sexual abuse material with no age checks. Collectively the apps were downloaded more than 350,000 times, meaning real people's photos were turned into non-consensual sexual content at meaningful scale before anyone intervened.
How it works, plainly: On download, an app quietly pings a server with details like location, language and a device ID; the server decides whether to show the advertised harmless app or unlock the explicit version, often triggered by arriving via a Meta ad. The sexual content lives on separate websites that look like blank screens unless accessed the right way, with URLs containing the word 'risk.' Researchers found the sites' code openly listed hundreds of sibling domains, shared encryption keys and ad-tracking IDs, showing one operator running the whole network from a single reused template.
The enforcement gap: After WIRED's outreach, Apple removed 19 apps, Google had already pulled most of the network and yanked the popular app DiffAI just before being contacted, and Meta said it has disabled 11,600 ad accounts, thousands of pages and 209 apps tied to the domains. Meta says it banned KeLing from advertising back in 2025. Yet researchers say new ads and apps kept appearing throughout the reporting, and after being contacted, the operators scrubbed their public links to KeLing rather than stopping.