Staff Reports
Wired’s big investigation blew the lid off a nasty secret hiding in plain sight on the app stores. More than 400 apps and nearly 500 domains—packaged as harmless pet-picture or language tools—were actually a commercial machine for making AI deepfake porn. The network served up templates with names like “bedroom rape” and even violent threats, and it used app stores and social media ads to hook users. That’s not a bug. It’s a business model built to prey on people and to spread non‑consensual images, including material that raises real child‑safety alarms.
What the investigation found
Researchers reverse‑engineered the apps and found a hidden web interface. The apps showed ordinary features until a user clicked through from a paid ad, or hit a trigger inside the app. Then the app loaded a secret “risk” URL and offered dozens of pornographic deepfake templates, selling “diamonds” to produce the images. AI Forensics and Infoblox traced the operation back to Chinese‑language code, Chinese hosting, and a Hong Kong‑registered name. At its peak the network pushed dozens of new apps a week and racked up hundreds of thousands of downloads. That level of scale means this was planned and professional, not a lone bad actor with a laptop.
How they hid the harm
The trick was simple and mean: bait‑and‑switch. The apps passed review by showing harmless content. Then the developer changed the remote content or only revealed the explicit tools when a user arrived from a Meta ad. A buried JavaScript file listed every domain and encryption key, so the whole network was tied together behind the curtain. In short: clever cloaking, mass advertising, and a payment flow that used Apple Pay and Google Pay to collect money for producing illegal, non‑consensual sexual images. That’s a perfect storm for victims and a nightmare for any parent.
Platforms asleep at the switch — and why that matters
Apple, Google and Meta all took action after Wired published the map of the network, but they were late to the party. Apple removed some apps and says it’s updated rules; Google removed many listings only after reporters raised the alarm; Meta says it took down thousands of related ads and accounts. Meanwhile, tens of thousands of people saw ads pushing the service, and some apps stayed live with millions of combined downloads. Platform delays matter because every hour of inaction multiplies victimization. If app stores and ad platforms cannot spot a catalog named “bedroom rape,” they are not doing basic safety checks.
Fixes aren’t hard — if companies choose to act
There are common‑sense steps: stronger app review that audits remote content, faster payments and ad‑account freezes when abuse is detected, public takedown lists, and clear legal obligations to notify victims. Law‑enforcement referrals should be automatic, and Congress should hold hearings to force answers about how these apps skirted controls. Tech companies like Apple, Google and Meta can stop treating safety like a PR problem and start treating it like liability. If they won’t, lawmakers must. The message is simple: no more shelters for businesses that traffic in AI deepfake porn or let “nudify” tools prey on children and adults. Enough excuses, more enforcement.
