A massive network of over 400 connected mobile applications managed to bypass safety reviews on major mobile platforms. These programs disguised themselves as innocent tools like pet photo editors, language tutors, and basic AI workout coaches. But underneath this friendly exterior, they offered hidden tools to create sexually explicit and violent deepfake images. Some of these malicious programs sat undetected in the App Store for about a year before getting caught.
Harmless looking tools hide a dark secret inside
The investigation started when security researchers noticed unusual advertising behavior on social media. They found a single organization in China that built hundreds of similar applications. The developers used fake names, generic privacy policies, and free email accounts to hide their true identity. When users installed one of these seemingly normal apps, they found hidden menus offering a much different service.
People could upload regular photos of anyone and turn them into non-consensual explicit or violent material. The developers sold credits to generate this content, and the payments were processed directly through official payment channels on both Apple and Google platforms.
Don’t miss the best of The Mac Observer
Set us as a preferred source and our Apple reporting ranks higher in your Google Search results and Discover feed — one tap, no account changes.
Companies scramble to pull the dangerous tools down
Once the extent of the network became public, tech giants moved quickly to clean up their storefronts. The iPhone maker removed 19 specific applications from its marketplace, including a popular pet portrait app named Viefur. The Android creator also pulled most of the offending software from its own digital shelves, taking down one specific app that had over 100,000 downloads.
Social networks played a big part in how these apps found their victims. The developers ran thousands of ads across major social platforms, pushing people to download the harmless-looking tools. To stop this spread, Meta blocked 209 of the applications from buying any more advertising and shut down over 10,000 ad accounts tied to the network.
While the major stores have strengthened their review processes against this specific type of threat, the incident shows how easy it still is for bad actors to use artificial intelligence to sneak dangerous features past basic security checks. The challenge now is keeping these hidden tools permanently off mobile devices.
Discussion