A network of more than 400 apps and websites presented themselves as ordinary AI services - such as pet portrait makers, language tutors, and workout coaches - but could secretly switch to tools for generating sexually abusive deepfake images and videos. Researchers found that the services let users upload someone’s photo and place them in explicit templates, including violent scenarios. Their apps checked information such as a user’s location and language before deciding whether to show the harmless version or the hidden interface; arriving through an associated social-media ad appeared to be one trigger. The network also promoted its tools with tens of thousands of ads on Facebook and Instagram, including ads depicting sexualized minors.
Researchers traced the operation to Chinese-language developers and a Hong Kong company, KeLing Technology Limited, citing shared code, hosting, domain records, and contact details. The apps appeared from late 2025, with dozens of new services registered in some weeks; one was downloaded more than 100,000 times, while the network’s apps collectively exceeded 350,000 downloads. Apple and Google removed apps after questions about their hidden functions. Apple said developers had changed content after approval, exploiting a bait-and-switch weakness in app review. Meta said it had banned KeLing from advertising and later took action against thousands of linked accounts, pages, and ads. The findings expose how operators can exploit app stores and ad systems despite platforms’ stated bans on nudification tools and abusive deepfakes.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
The US Commerce Department has delayed adding Singapore-based Megaspeed to a trade blacklist, despite concerns it helped smuggle Nvidia chips into China. Other agencies pushed for the listing, while Commerce said it needed more information about some companies under review. (ft.com)
Wyndham’s Android app contained a password that gave access to an internal database holding customer details, login tokens, and company files. Wyndham revoked the credential after a researcher reported it, but the company has not said how many records were exposed or whether customers will be notified. (techcrunch.com)
Seven months into Project Glasswing, Anthropic has logged 37,966 security findings but made only 217 fixes, while adding nearly 12,000 findings and just 15 fixes since September. Maintainers are also disputing many scanner reports, raising questions about the project’s claimed accuracy and the burden placed on open-source teams. (vulncheck.com)
rVPN is an open-source VPN protocol that disguises encrypted traffic as ordinary HTTPS to work around VPN blocking. It uses a Rust core, rotating encryption keys, and probe-resistant decoy responses, with code and builds available for verification. (rvpn.org)
CVE-2026-116928 is a remote code execution vulnerability in Windows Search. The provided information does not specify its cause, impact, or affected versions. (msrc.microsoft.com)
A flaw in OpenSSH on Alpine Linux and other musl-based systems can let attackers bypass password authentication with a single SSH connection. Install the security patch and restart OpenSSH; systems with password authentication enabled and no PAM are affected. (zdnet.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.