AI Deepfake Apps Exposed: 400+ Apps Hide Abusive Features

AI deepfake apps are easy to miss because many of them look like normal tools. A WIRED investigation published on 2 November 2026 linked more than 400 apps and domains to a network that hid abusive deepfake features. Parents and regular phone users should pay the most attention. The apps looked harmless during review. Researchers say some later gained the power to create sexual deepfakes of real people. This guide explains what was found and how the apps got through. It also covers what the platforms did and how you can check an app before you install it.

What Did WIRED Find About 400+ Apps Hiding AI Deepfake Tools?

WIRED reported that researchers connected more than 400 apps and domains to one network. Many were disguised as everyday apps such as photo editors and video makers. Behind the surface some could make AI generated deepfake images and videos.

The timeline matters. The network reportedly emerged in late 2025 and surged in spring 2026. Researchers also saw about 30 new app and website combinations registered every week.

Here are the key numbers from the investigation and the follow up coverage:

• 400+ connected apps and domains
• Almost 500 linked domains counted by Infoblox
• 19 apps removed by Apple
• 209 apps blocked from advertising on Meta
• 27 apps live on Google Play in September
• 350000+ downloads

“Nudify” apps use AI to make a real person look undressed. The person never agrees to it. That makes the output non consensual explicit imagery. It is also why this story matters beyond tech news.

How Did These Apps Hide Abusive Deepfake Features?

The apps used a bait and switch. On the surface the app looked clean. It had a simple name and a neat screen and a normal description in the store listing.

The risky part sat somewhere else. The app talked to a remote server. That server decided what content or tools the user could reach. A reviewer who tested the app would see nothing wrong. A user who arrived through an ad could see something very different.

Here is the pattern researchers described:

1. A user sees an ad on Facebook or Instagram.
2. The ad shows a deepfake style result or hints at it.
3. The user installs an app that looks like a basic AI image tool.
4. A hidden interface or feature unlocks the abusive tools.
5. The app asks for digital credits through in app purchases.

The money trail is part of the problem. Credits and subscriptions turned every download into revenue. That gave the network a reason to keep launching new apps.

If you follow how AI image tools are changing, our piece on Grok Imagine and its AI generated Odyssey shows how fast AI image and video generation is moving.

How Did Apps Pass App Store Review Without Being Caught?

App review checks what the app shows at the time of review. It does not always see what the app can do later. That gap was the opening.

Apple has said in other nudify cases that an app appeared to add prohibited features after passing review. This is the post approval content swap. The app gets approved in a clean state. Then the remote server turns on the harmful parts.

Apple has since updated its rules. In October 2026 it added Section 2.5.19 to the App Store Review Guidelines. The rule bars hidden or dormant or undocumented features. It also covers hiding features through code obfuscation. Breaking it can mean app removal and termination of the developer account.

This is a clear step. Rules alone will not close the gap unless stores also watch apps after launch.

For another example of risk that stays hidden in code for years, read our explainer on PHP2Shell and what AI found hiding in PHP.

How Did Researchers Link the Apps Together?

Two groups did most of the connecting. Paul Bouchaud from AI Forensics and Maël Le Touz from Infoblox traced the network through technical overlap.

They used a few simple signals:

1. Shared JavaScript bundle: Different apps and sites used the same underlying code.
2. Linked domains: Websites tied to the apps pointed back to each other.
3. Server behavior: The same server checks decided what content each app showed.
4. Registration patterns: New app and website pairs appeared on a steady weekly rhythm.

Researchers also pointed to KeLing Technology Limited. It is registered in Hong Kong and appeared in the links they found. Ownership of the network has not been confirmed. Treat the company name as a lead and not as a proven owner.

Which Apps Were Removed and Are Some Still Available?

Removals did happen. Apple removed 19 apps. Viefur and DiffAI are two examples of apps that were taken down.

Distribution did not stop though. Google Play still had 27 of the apps live in September. Similar ads were still being published after the removals. Meta blocked 209 apps from advertising. WIRED reported that Meta took action on 11600 ad accounts. 9to5Mac described the figure as more than 10000. Both numbers point to the same scale.

Platform	Reported action	Remaining concern
Apple App Store	19 apps removed and a new rule on hidden features	Apps can change after approval
Google Play Store	27 apps were still live in September	Review did not catch the swap
Meta (Facebook and Instagram)	209 apps blocked from ads and 11600 ad accounts actioned	Similar deceptive ads kept appearing

The lesson for readers is simple. Removal of one app does not remove the network. A new app with a new name can show up within days.

Pressure is also coming from officials. San Francisco’s city attorney sent cease and desist letters to Apple and Google earlier this year over nudify apps. Security gaps are not limited to app stores either. See how a federal agency handled its own weak spots in our post on the CFPB cybersecurity audit.

Why Are AI Deepfake and “Nudify” Apps Harmful?

The harm is direct and personal. These AI deepfake apps can turn an ordinary photo into a sexual image without consent. Anyone can be targeted. A classmate or a coworker or an ex partner or a stranger with a public profile.

The main risks are:

• Harassment and blackmail: Fake images get used to shame or threaten people.
• Lasting damage: Once an image spreads it is very hard to remove.
• Child safety: AI generated child sexual abuse material (CSAM) is a serious and growing concern. Minors can be targeted too.
• Easy access: A phone app removes the skill barrier. Anyone can use it in minutes.

Are AI nudify apps illegal? It depends on where you live. Many countries and US states now treat sharing non consensual sexual deepfakes as a crime. Creating or sharing such images of minors is illegal almost everywhere. If you are unsure about your situation talk to a local lawyer.

What Should App Stores Change to Stop This?

Stores need to treat approval as the start of review and not the end. These changes would help most:

• Ongoing checks after approval: Re test apps on a schedule and after any server side change.
• Network level removals: When one app is linked to others by shared code or domains remove the whole group.
• Tighter ad controls: Block ad accounts tied to removed apps before new ones launch.
• Stronger developer checks: Make it harder to open fresh accounts after a ban.
• Clear reporting tools: Let users flag a hidden feature in one tap and give them a response.

How to Check App Safety Before You Download

You do not need to be a security expert. A few habits cut your risk:

1. Be careful with apps promoted through ads on Facebook or Instagram.
2. Read recent reviews and look for complaints about hidden or adult features.
3. Check the developer name and whether it has other apps with a similar look.
4. Be wary of apps that push digital credits or weekly subscriptions right away.
5. Skip any app that asks for photos of other people to “transform” them.

How to Report and Get Help

• Report the app: Use the report option in the Apple App Store or Google Play listing.
• Report abusive ads: Use the three dot menu on the ad in Facebook or Instagram.
• StopNCII.org: An official resource that helps adults stop intimate images from spreading online.
• Take It Down: A service from NCMEC for images of people who were under 18.

Marketers should also watch how ad platforms handle trust and safety. Our guide on Google AI Mode ads covers how ad rules are shifting.

Final Thoughts

This investigation shows how AI deepfake apps can pass review by looking clean and then change after approval. Apple has tightened its rules and Meta has blocked many ads. Yet similar apps and ads kept appearing. Until stores check apps after launch you are your own first line of defense. Be careful with what you install and report what looks wrong. If someone targets you act fast and use the reporting tools above.

Frequently Asked Questions

Which apps were hiding AI deepfake features?

WIRED and researchers linked more than 400 apps and domains to one network. Many looked like everyday photo or video tools. Viefur and DiffAI are two named examples that were removed.

How do apps hide features from App Store review?

They show a clean version during review. A remote server then decides what the app can do after approval. This lets harmful tools appear later without a new review.

Were the apps removed from the App Store and Google Play?

Some were. Apple removed 19 apps and Meta blocked 209 apps from advertising. Google Play still had 27 of them live in September and similar ads kept appearing.

How can I check if an app is safe before downloading?

Read recent reviews and check the developer name. Be careful with apps that came from ads and push credits right away. Avoid any app that edits photos of other people in a sexual way.

What should I do if someone makes a deepfake of me?

Save evidence such as links and screenshots and do not share the image further. Use StopNCII.org if you are an adult or Take It Down if the image shows someone under 18. Report the content to the platform and contact local police or a lawyer if needed.