
Attackers hijack accounts of gay OnlyFans creators on X, demand crypto ransoms, and turn feeds into MAGA propaganda. FBI involved as pattern escalates.
A coordinated string of X account hijackings has targeted gay OnlyFans creators, with attackers demanding crypto ransoms and commandeering feeds to blast MAGA propaganda. The most prominent victim was Patrick Bewley, a 60-year-old adult performer known as Daddy Patrick, who had amassed 132,000 followers on the platform before his account was stolen in April, according to a report from WIRED.
The attack started on April 9. Bewley received a direct message from porn director Jasun Mark, whose own account was already compromised. The message asked Bewley to nominate someone for an award and directed him to a fake X login page. After he entered his credentials, the attacker changed the account's name, phone number, and email. The handle was swapped twice.
The hijacker rebranded the page with a Steve Bannon banner linking to his War Room platforms. By April 16, the account was posting pro-Trump images and demanding $2,000 in GAT tokens for its return. Bewley refused. The attacker then contacted his employer, Ducati Studios Network, upping the price to $3,000 in crypto. The feed began reposting 20 to 30 MAGA items a day from accounts like @MAGAVoice.
Bewley was not alone. Performer Fabian Quezada, who works as Buck Bronco, was locked out on April 12 and threatened over WhatsApp. He refused to negotiate, fearing he would be drained of his money. He replaced all his bank and credit cards as a precaution, WIRED reported.
Creators Liam Angell and Jasun Mark eventually recovered their accounts. Mark lost access for a month. During that time, the attacker fired crypto posts at his 68,000 followers. In May, Chicago creator Gray Dickson publicly pleaded for help after repeated phishing attempts.
X support did not help Bewley. Despite holding a paid verified account, the platform told him weeks later it could not confirm he owned the page. He filed reports with Palm Springs police and the Federal Bureau of Investigation.
Rachel Tobac, CEO of SocialProof Security, told WIRED the problem could intensify ahead of the US midterms. She suspects criminals are using AI to scale targeting of high-value accounts.
Last year, Paraguay's president suffered an X hack after his personal account posted a false claim that the country had adopted Bitcoin as legal tender. The official presidential account quickly flagged the post as fake and warned followers.
The pattern is straightforward: attackers target accounts with large, engaged followings in niche communities, use social engineering to steal credentials, then demand crypto ransoms. The MAGA content serves both as a political weapon and a way to make the account unusable for the original owner, increasing pressure to pay. For creators whose income depends on X's reach, the calculus is brutal. Pay the ransom and risk being targeted again. Refuse and lose months of audience building.
Tobac's warning about AI scaling suggests the attacks will become more frequent, especially as the US midterms approach and political account values rise. The FBI and local police are investigating Bewley's case. The decentralized nature of crypto payments makes tracing the attackers difficult.
Prepared with AlphaScala editorial tooling from the source reporting linked above. Indexable analysis may include a cited Alpha Score value. Publishing checks screen each story before release. Educational coverage, not personalized advice.