In mid-April the banner across a gay OnlyFans creator's X profile showed political imagery rather than erotica. The account belonged to Patrick Bewley, who posts as Daddy Patrick, and attackers had quietly rewired the account's contact details and replaced erotica with political posts while demanding cryptocurrency. When Bewley refused, the hijackers escalated and messaged his employer seeking a larger crypto payment, Wired reported. The episode is one of several extortion and impersonation cases targeting creators on social platforms, and it illustrates why phishing plus crypto payments has become the attackers' preferred playbook.
Bewley watched as a direct message that looked like it came from a colleague turned his account into a political billboard.
How the takeover unfolded. The intrusion began on April 9, when Bewley received a DM that appeared to come from the porn director and editor Jasun Mark. The message included a link that redirected to an X login page. Bewley later discovered that Mark's account had already been compromised and that the link was a credential-phishing lure that led him to enter his credentials on a fake page. By clicking the fake login, the attacker gained the access needed to change the account name, telephone number, and email.
The handle was altered in the days after the phishing link, and the hijackers replaced the avatar and banner with political imagery. In mid-April the compromised account posted MAGA propaganda and Trump-related content. In screenshots reviewed by Wired, the hijacker told a partner seeking help that they should pay to recover the account.
The attackers demanded cryptocurrency from Bewley. When he declined, they contacted his employer seeking a larger crypto payment.
Wired reported that Bewley was one of several gay OnlyFans creators targeted by recent crypto extortion campaigns on X, and that the perpetrators combined account takeover with public-facing propaganda posts to both coerce victims and amplify ideological content.
Security analysts and consumer guides trace the pattern to a mix of social engineering and payment friction. CreatorRated’s guide to OnlyFans scams warns that fake "free trial" and impersonation pages redirect users to credential-harvesting login forms, and that off-platform payment demands, including cryptocurrency, are a hallmark of schemes that bypass platform dispute mechanisms.
The California Department of Financial Protection and Innovation’s Crypto Scam Tracker classifies similar requests for upfront payment as advance-fee scams and lists crypto blackmail among common complaint categories.
Technical reports and security advisories show attackers have grown more sophisticated. Some phishers deploy fake verification flows that mimic Cloudflare CAPTCHAs and use scripts to trick victims into executing commands that install credential-stealing malware. Fraudsters favor cryptocurrency because transfers are irreversible and harder to trace. Some security researchers noted that LGBTQ+ people and communities can be especially vulnerable because sensitive identities can be exploited for blackmail or coercion.
Victims typically seek help from platform support and community networks. Wired’s reporting shows that while reporting to X prompted some interventions, it didn't always prevent hijackers from altering profile content or using hijacked accounts to amplify political messages and press ransom demands. That combination of public propaganda and private extortion turns a single account takeover into a broader reputational and safety problem for creators and their platforms.
Beyond the immediate financial demand, the campaign reveals an operational logic: the hijackers don't simply steal access and disappear. They repurpose high-following creator feeds to push political content while squeezing victims and their employers for quick crypto payments. That dual strategy raises two risks at once: creators face both economic extortion and the possibility their audiences will see content they didn't post.
The pattern also complicates recovery. Off-platform payments in cryptocurrency bypass protections such as chargebacks, and credential theft that includes changes to account contact details can slow or block normal account-recovery flows. CreatorRated and consumer trackers recommend treating unexpected login links as red flags, enabling multi-factor authentication, and routing any payment or negotiation through documented platform support channels rather than private crypto transactions.
Related Articles
- Golf buddy adviser ended friendship after 2 years
- 50% Off Summer Tech Week, but Inflation Complicates Upgrades
- Buffett's Cash Pile Signals Market Caution
The intruders demanded cryptocurrency from Bewley; when he refused, they contacted his employer seeking a larger ransom. Originally reported by Wired.
This article was created with AI assistance.
