Key facts
- Gay OnlyFans creators are having their X accounts hijacked by attackers demanding cryptocurrency.
- Hijacked accounts are being used to post MAGA propaganda and crypto spam.
- Patrick Bewley, an adult performer, had his account compromised and was asked for a $2,000 crypto ransom.
- The ransom demand increased to $3,000 when Bewley refused to pay.
- Other creators like Fabian Quezada, Liam Angell, and Mark have also been targeted.
- X provided no assistance to Patrick Bewley in recovering his account.
- Reports have been filed with local police and the FBI.
A wave of X (formerly Twitter) account hijackings targeting gay OnlyFans creators has emerged, with attackers demanding cryptocurrency ransoms and using the compromised accounts to spread political propaganda and crypto spam. Prominent adult performer Patrick Bewley, known as Daddy Patrick, was among the victims. His account, which had amassed over 132,000 followers, was taken over on April 9 after he clicked a malicious link from a hacked colleague's message, leading to a fake X login page.
Once Bewley's credentials were stolen, the attacker changed his account details, rebranded it with a Steve Bannon banner, and began posting pro-Trump content. A ransom of $2,000 in GAT tokens was demanded for the account's return. When Bewley refused to pay, the attacker contacted his employer, Ducati Studios Network, and raised the price to $3,000 in crypto. The account subsequently posted 20 to 30 MAGA-related items daily.
Bewley is not the only victim. Performer Fabian Quezada, also known as Buck Bronco, was locked out of his account on April 12 and threatened via WhatsApp. He refused to negotiate, fearing further financial loss. Other creators, including Liam Angell and Mark, eventually recovered their accounts after periods of being locked out, during which Mark's account with 68,000 followers was used for crypto promotions. Chicago-based creator Gray Dickson also publicly sought assistance in May due to persistent phishing attempts.
Despite holding a paid verified account, Bewley stated that X support offered no help, taking weeks to respond and claiming they could not confirm his ownership of the page. He has since filed reports with the Palm Springs police and the FBI. Rachel Tobac, CEO of SocialProof Security, noted to WIRED that this issue could escalate before the US midterms and suggested that criminals might be leveraging AI to scale their attacks on high-value accounts. Last year, Paraguay's president was also a victim of an X hack.