How Hackers Targeted Gay OnlyFans Creators With Crypto Extortion and MAGA Propaganda

Gay OnlyFans Creators Hit by Coordinated Crypto Extortion Scheme on X

For Patrick Bewley, known online as Daddy Patrick, X was a career-defining platform. After entering the adult content industry at 60 years old, the gay OnlyFans creator had built an impressive following of 132,000 users in less than two years — a milestone that carried real professional weight in the adult entertainment world. Then, in April, everything changed.

His feed, once filled with adult content and lifestyle posts, was suddenly broadcasting pro-Trump political messaging — things like proclamations about American oil dominance and imagery of Donald Trump labeled "STILL YOUR PRESIDENT." Bewley hadn't written a single word of it. His account had been stolen.

A Convincing Phishing Attack Opens the Door

The breach began on April 9, when Bewley received a direct message on X that appeared to come from a colleague — porn director and editor Jasun Mark. The message invited Bewley to nominate Mark for an industry award, a request that seemed entirely plausible. Bewley clicked the embedded link, which redirected him to what looked like an X login page. He entered his credentials, noticed nothing seemed to process, and moved on with his day.

It was a classic phishing trap. By the time Mark reached out to inform Bewley that he had never sent that message — his own account had already been compromised — the damage was done. Bewley's account had been taken over, with the attacker swapping out his registered name, phone number, and email address. His handle was first changed to @DADDYPATRIOzvu, then altered again the following day to @Fatherokdwcjo63.

Extortion Demands and Political Hijacking

When Bewley's partner Jerry Burt reported the hack from his personal account, the hijacker responded by transforming Bewley's stolen profile into a hub for far-right content. The account's banner and avatar were replaced with a stark black-and-white image of Steve Bannon promoting WarRoom.org, his political podcast platform. The profile's link tree was updated to direct visitors to Bannon's TikTok, Telegram, merchandise store, and official website.

A week after the initial attack, the hijacker posted a Trump image with a political caption and responded to Burt's public pleas for help with a blunt demand: pay up, or lose the account for good. The ransom? $2,000 worth of GAT cryptocurrency.

When Bewley declined, the attacker escalated — contacting his employer, Ducati Studios Network, a gay adult film production company where Bewley recently became Chief Marketing Officer, and demanding $3,000 in crypto.

After nearly two weeks of exchanges, Burt stopped responding. The hijacked account then shifted into what he described as a relentless propaganda machine, reposting between 20 and 30 pieces of far-right political content daily from accounts like @MAGAVoice, which identifies itself as pro-Elon Musk and dedicated to "taking back OUR country."

The Real-World Cost of Losing a High-Value Account

For adult content creators, follower count is more than vanity — it directly influences professional opportunities and perceived credibility. Bewley explained that surpassing 100,000 followers on X functions almost like a professional ranking within the industry, determining which collaborators and studios are willing to work with you.

"In a way, it dictates who will want to work with you," Bewley told WIRED. "It is the one platform people look at as the measure of where your standing is. And everybody wants to work with you if you have over 100,000 followers. You have automatic credibility."

He filed a police report in Palm Springs, where he resides, and submitted a complaint to the FBI. Despite holding a verified, paid X account, Bewley received no meaningful assistance from the platform. X reportedly told him they could not verify that he was the account's legitimate owner. WIRED's request for comment to X went unanswered.

Other Creators Caught in the Same Net

Bewley was far from the only target. On April 12, OnlyFans and JustForFans creator Fabian Quezada — who performs as Buck Bronco — discovered he had been locked out of his account and received a threatening message via WhatsApp demanding payment. Quezada refused to engage with the extortion attempt and never inquired about the ransom amount, reasoning that any further interaction could expose him to additional financial risk. As a precaution, he replaced all of his bank cards and credit cards.

Liam Angell, founder of Musclebearporn.com, and Jasun Mark both had their accounts compromised around the same period, though both were eventually able to regain access. Mark lost control of his account for an entire month during which the hijacker used it to broadcast cryptocurrency-related posts to his 68,000 followers. Despite the experience, Mark admitted he still had not activated two-factor authentication on his account.

In May, a Chicago-based creator named Gray Dickson posted a public appeal for help after repeatedly losing control of his account to phishing attacks, noting that the intrusions persisted even after he changed his password and revoked third-party app access.

Timing Raises Suspicions

The wave of attacks coincided with a platform-wide cleanup that X conducted in April, targeting fake, inactive, and spam accounts for bulk removal. That purge also swept up legitimate human-run alternate accounts, including many used within adult content communities. Bewley noted the suspicious timing, suggesting the cleanup may have given cybercriminals additional cover while also serving X's broader interest in removing adult content accounts.

Why MAGA Content Was Weaponized Against Gay Creators

For Bewley, the deliberate injection of far-right political content into a gay adult creator's account was not random — it was strategic and malicious. He views any association with MAGA ideology as professionally and personally devastating for someone in his position.

"Being associated with MAGA as a gay content creator is like saying you're a Nazi," Bewley said. "It's a no-go territory. There's no middle road." He believes the attacker chose this content precisely because it would cause maximum distress and push him toward paying the ransom more quickly.

By May, all posts had been scrubbed from the account's feed and it went dormant. The only remnants are the follower count Bewley had spent two years building and the link tree pointing to Steve Bannon's platforms.

Cybersecurity Experts Warn of a Larger Threat

Rachel Tobac, CEO of data protection firm SocialProof Security, sees these incidents as part of a growing and potentially more dangerous trend. With midterm elections approaching, she believes cybercriminals — likely now using artificial intelligence to scale their operations — may be deliberately targeting communities that lean away from right-wing politics.

"If I were a cybercriminal, and I also know that the right wing often has trouble with certain demographics, I am going to target accounts that they have trouble motivating," Tobac explained. "I would use AI to determine who has a large network and following within those groups, take over those accounts with phishing, extort them, and if the extortion stops working, I'll just stay dormant until it's election season."

She added that stolen accounts could be quietly absorbed into private networks operated by right-wing consulting organizations and activated for compensated political posting at strategically timed moments.

Starting Over From Scratch

Bewley has launched a new X account, which has already accumulated over 9,000 followers. He remains committed to rebuilding his presence, even as he acknowledges the steep uphill climb ahead.

"It's like building a sand castle against the tide," he said.

For creators navigating an increasingly hostile digital landscape, the message from cybersecurity professionals is straightforward: enable two-factor authentication immediately, scrutinize every link before clicking — even from trusted contacts — and never assume a familiar name in your inbox means a safe message on the other end.