Viefur app part of 400+ domain deepfake network

The investigation traces the network's origins to a JavaScript bundle found in the websites' code, which contained a configuration list of all the domains and apps created by the developers, including app package details, encryption keys, and Facebook advertising trackers. Maël Le Touz, a staff threat researcher at security firm Infoblox, identified almost 500 linked domains and noted that they run the same code and reference one another. Bouchard's analysis of domain registration found the apps started to appear toward the end of 2025, with a spike during the spring of this year. At one point, around 30 nudify apps and websites were being registered each week. One of the most popular apps, DiffAI, was created in December 2025 and had been downloaded more than 100,000 times from the Play Store. A user review stated that the app contained templates for creating CSAM and performed no age verification. DiffAI was removed shortly before WIRED contacted Google. Apple removed 19 apps, including Viefur, after WIRED asked about the activity. Meta says it banned KeLing Technology Limited from advertising in 2025 after it failed to comply with a cease and desist letter, and later took action against thousands of ad accounts, business pages, users, and pages linked to the domains.