Hundreds of Deceptive Apps Hide Deepfake Sexual Abuse Tools Behind Fake Portraits

A sprawling operation disguised within hundreds of seemingly ordinary apps is generating explicit deepfake imagery at scale. Researchers discovered that services ostensibly offering pet portraits, language tutoring, and fitness coaching are in fact fronts for creating sexually abusive artificial media—complete with scenarios depicting violence and child exploitation.

The investigation, which began with ads containing illegal material published on Meta platforms, revealed a sophisticated bait-and-switch scheme involving more than 400 interconnected apps and domains. The operation has been running for roughly a year, with peak deployment phases registering new apps at rates of up to 30 per week.

How the Deception Works#

The apps employ a conditional loading system that determines what each user sees. When downloaded, they contact servers to gather information about the source of the installation, user location, and device identifiers. Based on that data, servers decide whether to display innocent functionality—such as an AI pet portrait generator—or to activate a hidden interface for creating explicit material.

The apps that reach users through Meta advertisements appear particularly likely to unlock the deepfake layer. Once activated, these hidden interfaces present templates for pornographic scenarios, allowing users to upload photos of real people to be inserted into simulated sexual acts. The system monetizes through in-app purchases of virtual currency needed to generate images.

"Each time the application is downloaded, there is a call to the server with some information, such as where the user is coming from, the language, some unique identifier, and then the server replies whether or not to show the explicit or the non-explicit version of it," explains Paul Bouchaud, a lead researcher at nonprofit AI Forensics who reverse-engineered the apps.

Scale and Distribution#

Between late 2025 and mid-2026, the network deployed apps across both Google Play Store and Apple App Store. Google's store hosted 27 active apps in September 2026, collectively downloaded more than 350,000 times. Many were marked suitable for all ages. One particularly popular app, DiffAI, exceeded 100,000 downloads before removal. A user review flagged it for hosting "templates for creating CSAM and other types of pornographic material" with no age verification.

The apps were promoted through tens of thousands of Meta advertisements featuring explicit content, many containing imagery of minors. These ads used fabricated names and ran from pages with no followers, bypassing content moderation systems. In total, Meta later removed actions against 11,600 ad accounts, over 4,700 business pages, and 5,200 users connected to the scheme.