Locked Out and Forced Into 'MAGA': How a Crypto Extortion Ring Hijacked Gay OnlyFans Creators' X Accounts Several gay OnlyFans creators, including 60-something star 'Daddy Patrick', had their X accounts seized through phishing; attackers demanded crypto ransoms to return them and, when refused, flooded the feeds with crypto spam and right-wing 'MAGA' propaganda. Patrick Bewley's X feed usually carried adult content and clips of poolhouse erotica. Then, in April, it abruptly turned intensely political — and unmistakably MAGA — with posts such as, "President Trump stuns the World announcing America has more oil than the next two largest Oil economies COMBINED." The catch: Bewley hadn't written any of it. His account had been hacked. Who 'Daddy Patrick' Is Known online as Daddy Patrick, the gay OnlyFans star had decided to enter the adult industry at age 60, and in under two years his X following swelled to 132,000. Bewley is one of several gay OnlyFans creators TrendKia spoke to who were recently targeted by crypto scams on X, where attackers try to extort money from creators in exchange for handing back their accounts. In some cases, when the creators refused to cooperate, their feeds were stuffed with crypto posts — or, in Bewley's case, MAGA propaganda. A Trusted DM, Then a Vanished Account On April 9, Bewley received a DM on X from a coworker, the porn director and editor Jasun Mark, whose own account had already been hacked — though Bewley had no idea at the time. The message asked Bewley to nominate Mark for an award, and it felt harmless because, as he puts it, "it did sound kind of like something he would do." The link Mark sent redirected Bewley to an X page that asked for his login information, "but nothing was taking, or so I thought." Bewley carried on with his day. Later, after Mark told him he had never actually sent that award-nomination DM, Bewley went to check his page — and it was gone. By luring Bewley into clicking the fake link, the attacker was able to change the name, telephone number, and email on his account. The handle was first switched to @DADDYPATRIOzvu and, a day later on April 10, to @Fatherokdwcjo63. The Account Goes Into 'Crazy MAGA Mode' Bewley's partner immediately reported the hack to X from his personal account, saying the account had been stolen. Then things got strange: the account went into "crazy MAGA mode," Bewley says. The banner and avatar were swapped for a menacing black-and-white image of Steve Bannon advertising WarRoom.org, the official site for his politics podcast, complete with a linktree to Bannon's various platforms — his TikTok, Telegram, merch store, and official website. On April 16, a week after the initial attack, whoever had hijacked Bewley's account posted an image of Donald Trump with a text overlay reading, "GOOD MORNING, I'M STILL YOUR PRESIDENT." Beneath the post, Bewley's partner, Jerry Burt, asked how they could get the account back. In a series of screenshots reviewed by TrendKia, the hijacker wrote: "Just pay for it. That's all... You want this account or not? Ain't joking man." The Ransom Demands The asking price? $2,000 in GAT crypto. When Bewley refused to pay, the attacker messaged his employer, Ducati Studios Network — a gay porn production company he had recently joined as CMO — demanding $3,000 in crypto. After nearly two weeks of back-and-forth, Bewley's partner stopped engaging. The account then "started force feeding pro-MAGA propaganda," Burt says, reposting between 20 and 30 posts a day from extremist Republican pages like @MAGAVoice, the self-described "Proud Patriot. Pro Elon Musk" account that wants to "take back OUR country." A Major Blow to the Brand Losing the account dealt a serious blow to Bewley's brand. A high follower count, especially on X, creates the impression that you're a real player within the adult industry. "In a way, it dictates who will want to work with you," Bewley tells TrendKia. "It is the one platform people look at as the measure of where your standing is, almost like a ranking. And everybody wants to work with you if you have over 100,000 followers. You have automatic credibility." TrendKia contacted an account that appears to be linked to Bewley's hack but received no response. Other Creators Caught in the Net The attacks kept spiraling. On April 12, Fabian Quezada — an OnlyFans and JustForFans creator who performs as Buck Bronco — logged into X to check how his latest video, a collaboration with another creator, was doing, only to find himself locked out. "That's when I got a message on WhatsApp," Quezada says. In screenshots shared with TrendKia, the attacker tried to threaten him. "I don't care what you do with it. Not my main source of income. So go fuck yourself," Quezada shot back. Quezada says he never even asked how much it would cost to reclaim the account, because escalating things would "risk me being scammed out of all my money." The ordeal still forced him to change all of his bank and credit cards "just to make sure that nothing was compromised," he says. Other creators — including Liam Angell, the founder of musclebearporn.com, and Mark, the porn director — also had their X accounts hacked recently but have since recovered them. Mark lost access for a month and says the hijacker posted "a bunch of crypto tweets" and sent messages to his 68,000 followers. In May, a Chicago creator named Gray Dickson posted a plea on X after a string of phishing attacks: "If you haven't noticed someone keeps gaining access to my account and posting about crypto, even with me changing my password and revoking access to any outside device. Please help." Attacks Amid a Platform-Wide Purge The hacks began around the same time X launched an April-wide purge campaign to remove fake, inactive, or spam accounts in bulk. As TrendKia previously reported, that cleanup also led to the suspension and deletion of human-run alt accounts, including many used to privately curate niche porn. "I'm not a fan of conspiracy theories, but it was convenient that they would do a hacking in the middle of a purge," Bewley says, arguing the purge gave the cybercriminals useful cover while also helping X scrub porn accounts. Little Help From the Platform or Authorities Bewley had a verified account, which he continues to pay for, but says he got no benefit from X support in trying to recover it. Weeks after the hack, X replied to tell him it had no way to verify that he was the account's true owner. X did not respond to a request for comment. He also says he filed a police report in Palm Springs, where he lives, and a report with the FBI. Mark, who leans on X to promote his movies, fears another attack could happen, yet admits: "I still haven't fucking learned my lesson because I still don't have two factor put on there. I'll get around to it." Tying Gay Creators to MAGA — a Targeted Cut While crypto scams have grown increasingly common, Bewley says linking gay sex workers to MAGA feels especially deliberate and malicious. He sees any association with right-wing ideology as toxic. "If you ask me what the potential loss is, being associated with MAGA as a gay content creator is like saying you're a Nazi. It's a no-go territory. There's no middle road," Bewley says. "[The hacker] knew that would be distressing for me. And so that I would be more likely to want to shut it down." In May, every post was wiped from the account's feed and it went inactive. All that's left are the followers and the linktree to Bannon's War Room platforms. What Comes Next — and Why It Could Get Worse Phishing scams, and the pipeline for extorting high-value accounts, are nothing new, but Rachel Tobac, CEO of data protection company SocialProof Security, thinks the problem could intensify with the upcoming midterm elections. While it isn't clear that was the motive in these particular hacks, she suspects cybercriminals are now leaning on AI to scale their operations. "If I were a cybercriminal and I also know that the right wing often has trouble with certain demographics, I am going to target accounts that they have trouble motivating," she says. "I would use AI to determine who has a large network and following within those groups, take over those accounts with phishing, extort them, and if the extortion stops working, I'll just stay dormant until it's election season. It's the perfect time to work with private online networks operated by right wing consulting organizations where stolen accounts can participate in political posting for compensation." Bewley has since built a new X page that already has over 9,000 followers. He isn't put off by having to start from scratch, but says the process is "like building a sand castle against the tide." What this means for you What this means for you: • For content creators: Changing your password alone won't save you — pause before entering your login on any link, even an 'award' invite from a familiar name, and switch on two-factor authentication, because large-following accounts are being hunted directly. • For everyday X users: A trusted contact's hacked account can be used to send you phishing links, so never enter login details from a DM link, and if you're compromised, change your bank and card details immediately. Questions & Answers 1. How was Patrick Bewley's account hacked? On April 9 he got a DM appearing to come from coworker Jasun Mark (whose account was already hacked) with an award-nomination link; that link sent him to a fake login page, which let the attacker seize his account. 2. How much ransom did the attackers demand? They demanded $2,000 in GAT crypto from Bewley, and when he refused, asked his employer Ducati Studios Network for $3,000 in crypto. 3. What happened to the account after he refused to pay? It was flooded with a Steve Bannon image and pro-MAGA posts — 20 to 30 reposts a day — and in May all posts were wiped and the account went inactive. 4. Did X or the police help him recover it? Despite his verified account, X said it had no way to verify he was the true owner; he filed reports with police in Palm Springs and with the FBI. https://trendkia.com/en/security/ge-onlyfans-stara-ke-x-akaunta-para-kripto-jabarana-vasuli-ka-hamala-phirauti-na-1006 TrendKia — Har trend, sabse pehle.