The app marketed as a pet portrait generator, Viefur, lets users spend roughly four dollars for 130 digital coins to turn animal photos into cartoonish scenes such as a hamster in beach shorts. While the advertised feature appears harmless, the application serves a far more sinister purpose that emerged only after technical analysis revealed hidden functionality.
Researchers identified a sprawling network of more than 400 related domains and mobile applications that present themselves as language tutors, fitness coaches, or other routine services. When certain conditions are met, the apps silently load a web interface that offers templates for explicit sexual scenarios, including violent scenes described as “bedroom rape” and “threatening knife.”
The network first came to light after investigators traced thousands of video advertisements on Meta’s Facebook and Instagram platforms. Those ads displayed AI-generated child sexual abuse material and even images of a European royal, reaching tens of thousands of viewers and prompting regulatory inquiries across multiple jurisdictions.
Despite public policies that ban harmful deepfakes, the deceptive tools were distributed through Apple’s App Store and Google Play, allowing users to pay via Apple Pay or Google Pay. The developers released new variants at a rate of dozens per week for roughly a year, exploiting the stores’ review processes to reach a combined download count exceeding 350,000.
Domain registration data and server logs point to Chinese developers operating under the Hong-Kong-registered entity KeLing Technology Limited. Email addresses tied to the company failed to respond to requests for comment, and after contact was made, the developers appeared to scrub public links between KeLing and the illicit services.
Technical analysis showed that each installation contacts a remote server, sending data such as location, language and a unique identifier, then receives instructions on whether to display the benign or explicit version. “Each time the application is downloaded, there is a call to the server,” explained Bouchaud, who reverse-engineered the code.
Visiting the associated websites often yields a blank page, but the URL changes to include the term “risk,” indicating that the hidden deepfake layer is being activated. Within this layer users find dozens of pornographic templates, the ability to purchase “diamonds” for image generation, and contact links for the developers, while a JavaScript bundle lists all related domains, encryption keys and advertising trackers.
Apple responded by removing 19 applications, including Viefur, after being alerted to the misconduct. An Apple spokesperson said, “We designed the App Store to be safe,” and noted that the apps complied with review guidelines before developers switched the backend content to pornographic material, prompting a broader crackdown on bait-and-switch tactics.