A coordinated network of more than 400 abusive deepfake apps managed to bypass Apple and Google app store reviews by disguising themselves as ordinary photo, fitness and translation utilities, cybersecurity researchers and investigative reports revealed on 2 November 2026.
Key points
- A single commercial network created over 400 disguised apps and websites that concealed non-consensual sexual and violent image generators behind benign interfaces.
- Developers used server-side cloaking to pass app store checks, triggering explicit web tools only when users opened apps through deceptive social media adverts.
- Apple removed 19 applications and Google purged dozens of listings after researchers detailed how the software bypassed safety filters and processed in-app payments.
- Meta banned thousands of linked advertising accounts, though researchers warned that operators continue to register new disposable domains and listings.
How the bait-and-switch operation worked
To ordinary smartphone users and app review teams, the software appeared harmless. One application named Viefur marketed itself as an image tool that placed pets into cartoon portraits, dressing cats in shirts or setting hamsters by swimming pools for four dollars in digital tokens. Other listings claimed to offer language tutorials or virtual workout coaching.
Beneath the surface, each download acted as a conduit to an external generation system. When a user opened an app, the software sent device data back to an offshore server, transmitting details such as language preferences, device identifiers and referral paths. If the server decided conditions were met, it swapped the standard interface for an embedded browser displaying explicit image and video generators.
Researchers who investigated the network discovered that clicking on targeted social media promotions served as a primary trigger. Users directed from explicit video adverts on Facebook and Instagram were served interfaces containing templates for generating non-consensual pornography, sexual violence and threatening scenes using uploaded photographs of real people.
The hidden web pages let users buy digital tokens to generate videos, directing payments through mobile billing systems. The infrastructure concealed its code behind websites that displayed blank screens and flagged browser addresses with risk warnings when visited directly on desktop computers.
Code analysis reveals an organised network
Cybersecurity analysts unpicked the architecture by examining the scripts bundled inside the web interfaces. Staff threat researchers at security company Infoblox discovered configuration files listing nearly 500 connected domains, each sharing identical code structures, encryption keys and tracking pixels tied to advertising campaigns.
Analysis of domain registration records showed that the group began publishing services in late 2025 before accelerating through the first half of 2026. At peak periods, the operators registered roughly 30 new domains each week, launching disposable apps to replace any titles flagged by platform monitors.
By September 2026, researchers found 27 active titles on Google Play alone, which had accumulated more than 350,000 installations. Many carried content ratings listed as suitable for all age groups, meaning children could install them without triggering parental blocks.
One title called DiffAI logged more than 100,000 installations after launching in December 2025. User reviews left on the marketplace warned that the software hosted abusive templates and conducted no age verification, yet the app remained accessible until researchers presented their findings directly to the platform owners.
Infrastructure traced to Hong Kong and mainland developers
Technical evidence collected across the domains pointed to an operation managed by developers in China. Server hosting was based in mainland infrastructure, while the underlying source code contained extensive comments written in Mandarin. Promotional video clips posted online displayed default watermarks from Chinese video editing platforms.
Domain records linked the earliest websites in the cluster to KeLing Technology Limited, an entity registered in Hong Kong. The firm name appeared in administrative login screens, contact records and customer support channels tied to the abusive generator templates.
In late September 2026, an update pushed across the network promoted an upgraded synthetic model named Veyra, claiming more natural output. The public landing page for Veyra listed an administrative email address belonging to the KeLing domain.
When reporters approached the listed contact addresses, the operators did not respond. Instead, administrative details linking KeLing Technology to the websites were quietly wiped, social media accounts were renamed, and domain records were stripped of direct identifying markers.
How abusive deepfake apps evaded platform review
The campaign succeeded by exploiting gaps between static application code reviews and dynamic web hosting. Both Apple and Google inspect binaries submitted by software creators, checking for malicious functions, restricted application programming interfaces and prohibited content before approving distribution.
By delivering the abusive functionality through remote web views loaded after approval, the developers bypassed initial scrutiny. Apple confirmed that it removed 19 applications after reviewing evidence provided by journalists, noting that the software had complied with rules during formal evaluation.
Adam Dema, an Apple spokesperson, said developers altered the external websites that apps pulled content from after passing inspection. Apple stated that it has suspended tens of thousands of apps over the past year for attempting similar bait-and-switch manoeuvres and recently updated its app store rules to tighten restrictions against non-consensual nudification software.
Google purged the identified applications from Google Play following external warnings. The disclosures add fresh pressure on mobile marketplaces, which already face heightened regulatory oversight and scrutiny over app store fee structures, including South Korea app store fines over billing controls.
Social media promotion and advertising failures
The distribution engine relied heavily on automated paid campaigns across Meta platforms. Investigators at the Tech Transparency Project, who first uncovered the ads promoting abusive synthetic imagery, found that automated campaigns served promotional clips depicting non-consensual material directly to mainstream user feeds.
The advertisements directed viewers into Apple and Google app listings, using nonsensical business names and freshly registered commercial profiles with zero followers to bypass automated ad screening. Campaign accounts were cycled rapidly to stay ahead of automated fraud filters.
Meta stated that it banned KeLing Technology Limited from its commercial systems in 2025 after issuing a cease-and-desist letter. However, the operators circumvented the restriction by purchasing placements through surrogate accounts and shell organisations.
Following the submission of technical evidence, Meta reported taking enforcement action against 11,600 advertising accounts, 4,700 business profiles and 15,000 individual pages connected to the network, blocking more than 200 associated apps from running commercial campaigns.
What happens next
Platform operators continue to battle fresh variants of the software as developers rebrand and deploy new hosting clusters. Researchers tracking the infrastructure noted that identical code bundles and cloned interfaces reappeared under fresh domain names within days of platform suspensions.
Child safety advocates and digital rights organisations have urged consumer technology firms to restrict remote web views inside mobile applications and implement stricter identity verification for software publishers. Regulatory authorities in Europe and North America are examining whether current app marketplace auditing procedures meet legal duties to protect users from automated sexual abuse material.
