400+ Cloaked Apps and Domains Tied to KeLing Technology Limited Deliver Abusive Deepfake Nudify Tools via Meta Ads
A WIRED investigation, with research from AI Forensics and Infoblox, found a network of more than 400 connected domains and apps that pose as benign utilities (AI pet photos, language tuition, workout coaching) but, under certain conditions, load a hidden web interface for generating sexually explicit and abusive deepfakes, including content depicting rape and violence. The network appears run by Chinese developers and a Hong Kong-registered entity, KeLing Technology Limited. It was promoted through tens of thousands of explicit ads on Meta's Facebook and Instagram, some containing AI-generated CSAM, and distributed via Apple App Store and Google Play. Apps were downloaded 350,000+ times in total, and similar ads and apps continued to appear as reporting concluded.
Detalhes técnicos
- Cloaking / bait-and-switch: on each launch the app calls a server with data such as origin, language and a unique identifier, and the server decides whether to show the benign or the explicit version. One trigger appears to be installing after clicking a Meta ad.
- Apple says developers changed the website the app pulls content from after approval, replacing the reviewed content with pornographic content.
- Associated websites show a black screen with the URL updated to include "risk" while hosting the hidden explicit layer, which offers dozens of video and image templates, upload of people's photos, and purchase of "diamonds" for generation.
- A JavaScript bundle contains a configuration list of all network domains and apps, including package details, encryption keys and Facebook ad trackers. Infoblox identified almost 500 linked domains that run the same code and reference each other.
- Attribution indicators: exclusive Chinese hosting, Chinese-language code and comments, watermarks from Chinese video-editing software in ads, and KeLing Technology Limited appearing in the contact details of the first registered website, in the explicit template and in an admin login page. Apps used generic privacy policies, free Gmail/Outlook addresses, obscure developer names and fake advertiser names.
- Domains began appearing late 2025, spiking in spring 2026 (about 30 per week). 27 apps were live on Google Play in September. DiffAI (100,000+ downloads) was removed before WIRED made contact. A new AI model, Veyra, was announced to users in late September.
Remediação
- Apple removed 19 apps (including Viefur) and says it has suspended tens of thousands of apps for bait-and-switch tactics and tightened its nudify rules. Google removed most of the apps.
- Meta says it banned KeLing in 2025, and later acted against 11,600 ad accounts, 4,700+ business pages, 5,200 users and 15,000 pages, and blocked 209 apps from advertising.
- After WIRED's contact, KeLing links were scrubbed from some sites and social channels.
Linha do tempo
-
400+ Cloaked Apps and Domains Tied to KeLing Technology Limited Deliver Abusive Deepfake Nudify Tools via Meta Ads
ler a análise desta fonte ocultar
A WIRED investigation, with research from AI Forensics and Infoblox, found a network of more than 400 connected domains and apps that pose as benign utilities (AI pet photos, language tuition, workout coaching) but, under certain conditions, load a hidden web interface for generating sexually explicit and abusive deepfakes, including content depicting rape and violence. The network appears run by Chinese developers and a Hong Kong-registered entity, KeLing Technology Limited. It was promoted through tens of thousands of explicit ads on Meta's Facebook and Instagram, some containing AI-generated CSAM, and distributed via Apple App Store and Google Play. Apps were downloaded 350,000+ times in total, and similar ads and apps continued to appear as reporting concluded.
Technical Details
- Cloaking / bait-and-switch: on each launch the app calls a server with data such as origin, language and a unique identifier, and the server decides whether to show the benign or the explicit version. One trigger appears to be installing after clicking a Meta ad.
- Apple says developers changed the website the app pulls content from after approval, replacing the reviewed content with pornographic content.
- Associated websites show a black screen with the URL updated to include "risk" while hosting the hidden explicit layer, which offers dozens of video and image templates, upload of people's photos, and purchase of "diamonds" for generation.
- A JavaScript bundle contains a configuration list of all network domains and apps, including package details, encryption keys and Facebook ad trackers. Infoblox identified almost 500 linked domains that run the same code and reference each other.
- Attribution indicators: exclusive Chinese hosting, Chinese-language code and comments, watermarks from Chinese video-editing software in ads, and KeLing Technology Limited appearing in the contact details of the first registered website, in the explicit template and in an admin login page. Apps used generic privacy policies, free Gmail/Outlook addresses, obscure developer names and fake advertiser names.
- Domains began appearing late 2025, spiking in spring 2026 (about 30 per week). 27 apps were live on Google Play in September. DiffAI (100,000+ downloads) was removed before WIRED made contact. A new AI model, Veyra, was announced to users in late September.
Remediation
- Apple removed 19 apps (including Viefur) and says it has suspended tens of thousands of apps for bait-and-switch tactics and tightened its nudify rules. Google removed most of the apps.
- Meta says it banned KeLing in 2025, and later acted against 11,600 ad accounts, 4,700+ business pages, 5,200 users and 15,000 pages, and blocked 209 apps from advertising.
- After WIRED's contact, KeLing links were scrubbed from some sites and social channels.