Apple Removes 19 Apps After Hidden Deepfake Tools Exposed

Apple has removed 19 apps from its App Store after an investigation linked seemingly ordinary AI utilities to tools for creating abusive deepfake images. The removals followed questions from WIRED, whose investigation was published on 2 November. The wider network identified by WIRED and researchers spans more than 400 connected apps and websites. That figure should not be confused with the 19 apps Apple says it removed.

One app presented itself as a pet-portrait service. Other services in the network resembled language tutors or workout coaches. WIRED found that under certain conditions they loaded a different web interface that allowed people to make explicit sexual images and videos from uploaded photographs. Researchers traced links from thousands of advertisements on Facebook and Instagram to the apps and associated sites.

Apple’s account is that the apps complied with its rules when reviewed, but their developers later changed the websites from which the apps loaded content. That let an approved shell display different material after publication. The company says nudification apps and pornography are prohibited on its store and that it has taken action against many apps using similar bait-and-switch tactics. This explanation points to a weakness that a one-time review cannot solve on its own: an app can be updated in effect by changing what its remote service serves.

Google had removed most of the relevant apps from Play before WIRED contacted it, the report says. Researchers cited there counted 27 live on Play in September and more than 350,000 cumulative downloads across those apps. Those are research findings reported by WIRED, not an independent count by TechBooky. Google did not respond to WIRED’s request for comment.

The problem extends beyond app stores. Advertising gives such services a route to buyers, while payment systems can turn abuse into a business. WIRED described tens of thousands of explicit ads linked to the network on Meta platforms this year. Researchers argue that repeated disposable apps, domains and advertising accounts can outpace removals unless platforms detect the connections between them.

The immediate action is the removal of the identified apps. The wider test for Apple, Google and Meta is whether their systems can catch a developer that appears harmless during review and changes behaviour later. More continuous checks of remote content, linked domains and advertising patterns may matter as much as tighter rules on paper. TechBooky previously covered TikTok’s experiment with likeness detection, a different attempt to give people more control over misuse of their images.

For users, a familiar app-store badge is not proof that every feature is safe or that a developer’s conduct will stay unchanged. The investigation is a reminder that consent and identity protection have to be built into the entire distribution chain, from the advertisement to the app and the remote service behind it.