More than 400 connected apps and websites that looked like pet-photo editors, language tutors and AI workout coaches secretly contained tools for making sexual and violent deepfakes from uploaded photos, according to a Wired investigation published on 2 November 2026. The apps passed review on Apple's App Store and Google Play, and were promoted through thousands of video ads on Facebook and Instagram.
How it worked
Wired reported that the apps used a bait-and-switch. During app-store review they showed ordinary content and complied with the rules. Afterwards, a check on the developer's server could switch on a hidden web interface for generating explicit and abusive images and videos. Wired says some hidden templates depicted sexual violence and threats, and that researchers found the network by following links in explicit deepfake ads on Meta's platforms. The network is reported to have operated for roughly a year. Security firm Infoblox reportedly counted nearly 500 linked domains sharing the same code and encryption keys, and some apps passed 100,000 downloads.
What the companies did
- Apple removed 19 apps after Wired shared details. A spokesperson said every app is reviewed before it is published, that these complied with the rules at the time, and that Apple has suspended tens of thousands of apps over the past year for similar tactics. Apple recently updated its guidelines on nudification tools and hidden functionality.
- Meta said it acted against 11,600 ad accounts and 15,000 pages linked to the network. A researcher cited by Wired found tens of thousands of related explicit deepfake ads on Meta's platforms this year.
- Google had not publicly announced a matching list of removals in the coverage reviewed, though the apps were also on Google Play.
Wired reported that similar apps and ads were still appearing as its reporting concluded. The researcher who tracked the network said its operators do not expect enforcement to catch up, and that so far it has not. Reporting based on Wired's findings links the network to Chinese-language infrastructure and a single operator that concealed its identity behind generic names and privacy policies.
Why it matters
Non-consensual sexual deepfakes are a form of abuse that can be used to humiliate, blackmail and threaten people, and they most often target women and girls. This case shows that app-store review at the point of publication can be defeated when an app's behaviour changes afterwards, and that ads on social media can steer users to tools that violate the platforms' own rules.
What you can do
- Be cautious about apps promoted through ads with suggestive or shocking content, and check who the developer is, reviews and requested permissions.
- Be careful about uploading photos of yourself or others to any app you do not trust.
- If someone has made or shared a fake intimate image of you, keep screenshots and links as evidence and report it to the platform and, where appropriate, to the police. Adults can use StopNCII.org to help stop intimate images spreading, and people under 18 can use the NCMEC's Take It Down service.
- Report suspicious apps and ads to the app store or social platform.
Sources: Wired investigation (2 November 2026), as reported by 9to5Mac, Northeast Times, AI Weekly, FourWeekMBA, MLQ and TechBytes.
