Software · 2 November 2026 · 4 min read
Pet Portraits and Fitness Coaches: How Hundreds of Mobile Apps Hid Deepfake Generators
In brief: An international investigation by Wired and the nonprofit AI Forensics has uncovered a coordinated network of more than 400 seemingly harmless applications and web domains operating within Apple's App Store and Google Play. Posing as pet photo editors or language tutors, the apps deployed dynamic cloaking techniques to pass review filters, subsequently serving hidden interfaces that generated sexually abusive deepfakes monetized through standard in-app purchase systems.
by Team Mocchi's
At first glance, they looked like unremarkable consumer utilities powered by generative artificial intelligence: tools to turn pet pictures into cartoon portraits, interactive language tutors, or pocket workout coaches. In reality, behind hundreds of programs hosted on Apple's App Store and Google Play operated an industrial-scale operation designed to produce and sell nonconsensual sexually explicit deepfake imagery.
As an extensive investigation published by WIRED revealed, the network spanned more than 400 domains and mobile applications connected to Chinese-speaking developers and a Hong Kong-registered entity known as KeLing Technology Limited. The operation ran for approximately twelve months, churning out dozens of disposable apps each week to stay ahead of platform defenses.
Using cloaking techniques to bypass store review
The entire mechanism relied on cloaking, a dynamic evasion technique long familiar to cybersecurity researchers. Whenever an application was being reviewed by Apple or Google review teams, the backend server served only the benign feature set detailed in the public store listing, such as dressing cats and hamsters in vacation attire.
Once the app was approved and downloaded by end users, its behavior shifted dynamically based on external triggers or referral parameters. The client then quietly loaded an embedded webview that granted access to an interface for uploading photographs of real individuals and generating explicit or violent media, neatly bypassing the static code inspections used by app store operators.
In-app billing and social advertising pipelines
Among the most alarming aspects uncovered by the investigation is the monetization and customer acquisition apparatus. The abusive generators did not require underground payment rails or cryptocurrencies: credit packs were purchased directly through standard in-app billing via Apple Pay and Google Pay, granting an aura of official legitimacy to the services.
User traffic was systematically funneled through tens of thousands of video advertisements placed across Instagram and Facebook. These ads explicitly showcased synthetic nudification features and routed viewers directly to verified app listings on the official mobile marketplaces. As documented by researchers at AI Forensics, campaigns were registered under burner ad accounts with falsified billing identities, allowing the operators to replace shut-down campaigns almost instantly.
Disposable architecture outpaces platform moderation
The network managed to persist through sheer architectural redundancy: disposable software distributed across a wide web of separate developer accounts. Whenever a specific app or ad account was flagged and terminated, dozens of identical clones with modified names and icons were already queued up to replace it.
While Apple and Google took down the offending apps following the journalists' inquiries, and Meta suspended the associated advertising profiles, the case underscores how pre-publication app reviews fail against server-driven dynamic payload injection.
Mocchi's take
This investigation exposes a structural vulnerability in today's software distribution landscape: static review gates at intake are powerless against mobile shells that dynamically pull arbitrary logic from the cloud. For engineering teams designing secure architectures and digital platforms, the takeaway is unequivocal: compliance and security cannot remain a one-time deployment milestone, but must involve active runtime inspection of network traffic and embedded web components. As off-the-shelf generative models proliferate, platform integrity will depend on monitoring the full software lifecycle, bridging the blind spots between official payment pipelines, ad distribution channels, and backend infrastructure.