A server decides which app you get
Hundreds of ordinary-looking iPhone apps carried a second face, revealed only after a specific chain of events. Install one from an Instagram ad and the software called home with the referrer and device language; the answer switched on an explicit image generator instead of a pet photo tool.
The WIRED investigation by Matt Burgess, published November 2, mapped a network well past 400 connected apps and sites. Apple took down 19 after seeing the evidence. The same catalogue ran on Google Play, where 27 titles were active in September with more than 350,000 installs, many rated for all ages.
Bait kept the listings clean
Most of the catalogue posed as language tuition, workout coaching or photo editing. One app, Viefur, offered to add clothing to pictures of pets. Roughly $4 bought 130 coins through Apple or Google Pay, and the templates unlocked included violent scenarios too.
Apple told the magazine the submissions complied with storefront rules during review, and that developers later swapped the website the apps pulled content from, replacing approved material with pornography.
One company behind the whole shelf
Researchers at AI Forensics and Infoblox traced roughly 500 interlinked domains. Infoblox’s Mael Le Touz found shared configuration lists, encryption keys and near-identical code, pointing to a single Hong Kong entity, KeLing Technology Limited. AI Forensics lead Paul Bouchaud described an organised commercial operation running disposable apps under fake payer names.
The apps began surfacing in late 2025, at a peak of about 30 app-and-site pairs each week. Meta says it acted on 11,600 ad accounts and 15,000 pages.
On October 16, Apple tightened App Review rules to name AI-generated nonconsensual intimate imagery and hidden features directly. From December 2, EU providers of such tools must add safeguards or leave the market.
