Patrick Bewley’s X feed was normally filled with posts about leather three-ways and clips of poolhouse erotica.

The gay OnlyFans star, known as Daddy Patrick, had decided to get into the adult industry at age 60 and in under two years his followers on X swelled to 132,000. But in April, his feed suddenly became very political—and very MAGA—with posts like “President Trump stuns the World announcing America has more oil than the next two largest Oil economies COMBINED.”

Except it wasn't Bewley behind the change. His account had been hacked.

Bewley is one of several gay OnlyFans creators WIRED spoke to who was targeted by recent crypto scams on X, where attackers are attempting to extort money from creators to get their accounts back. In some cases, when they refused to cooperate, their accounts were filled with posts about crypto, or, as with Bewley, MAGA propaganda.

On April 9, Bewley received a DM on X from a coworker, the porn director and editor Jasun Mark, whose account had already been hacked, though Bewley didn’t know it at the time. The message, which asked Bewley to nominate Mark for an award, seemed harmless because “it did sound kind of like something he would do,” he says. The link Mark sent redirected Bewley to an X page that asked for his login information “but nothing was taking, or so I thought.” Bewley went about his day and later, after Mark notified him that he hadn’t actually sent that DM about the award nomination, he went to check his page and it was gone.

By tricking Bewley into clicking on the fake link, the attacker was able to change the name, telephone number, and email on Bewley’s account. The handle was first changed to @DADDYPATRIOzvu, and a day later, on April 10, to @Fatherokdwcjo63.

Bewley’s partner immediately reported the hack to X from his personal account, saying it had been stolen. Then something strange happened: The account went into “crazy MAGA mode,” Bewley says. The banner and avatar were changed to a menacing black-and-white picture of Steve Bannon that advertised WarRoom.org, the official site for his politics podcast, with a linktree to Bannon’s various platforms, including his TikTok, Telegram, merch store, and official website.

On April 16, a week after the initial attack, whoever hijacked Bewley’s account posted an image on the compromised X account of Donald Trump, with a text overlay that read “GOOD MORNING, I’M STILL YOUR PRESIDENT.” Under the post, Bewley’s partner, Jerry Burt, asked how they could get the account back. “Just pay for it. That’s all,” the account hijacker wrote in a series of screenshots reviewed by WIRED. “You want this account or not? Ain’t joking man.”

The asking price? $2,000 in GAT crypto.

When Bewley refused to pay, the attacker messaged his employer, Ducati Studios Network, a gay porn production company where he recently joined as CMO, demanding $3,000 in crypto.

Bewley’s partner stopped engaging after nearly two weeks of back and forth. The account then “started force feeding pro-MAGA propaganda,” Burt says, reposting between 20 to 30 posts a day from extremist Republican pages like @MAGAVoice, the self-described “Proud Patriot. Pro Elon Musk” account that wants to “take back OUR country.”

The loss of the account has been a major blow to Bewley’s brand. A high follower count, particularly on X, gives the perception that you are a player within the adult industry. “In a way, it dictates who will want to work with you,” Bewley tells WIRED. “It is the one platform people look at as the measure of where your standing is, almost like a ranking. And everybody wants to work with you if you have over 100,000 followers. You have automatic credibility.” WIRED contacted an account that appears to be associated with Bewley’s hack but did not receive a response.

The attacks have only continued to spiral. On April 12, Fabian Quezada, an OnlyFans and JustForFans creator who performs as Buck Bronco, went to log into X to see how his latest video—a collaboration with another creator—was doing, but found himself locked out. “That’s when I got a message on WhatsApp,” Quezada says. In a series of screenshots shared with WIRED, the attacker attempts to threaten Quezada. “I don’t care what you do with it. Not my main source of income. So go fuck yourself,” Quezada responded.

Quezada said he never asked how much it would cost to get the account back because escalating the situation would “risk me being scammed out of all my money.” The ordeal forced him to change all his bank and credit cards “just to make sure that nothing was compromised,” he says.

Other creators, like Liam Angell, the founder of musclebearporn.com, and Mark—the porn director—also recently had their X accounts hacked but have since been able to retrieve them. Mark lost access for a month and says the hijacker posted “a bunch of crypto tweets,” and sent messages to his 68,000 followers.

In May, a creator in Chicago named Gray Dickson posted a plea on X asking for help following a series of phishing attacks. “If you haven't noticed someone keeps gaining access to my account and posting about crypto, even with me changing my password and revoking access to any outside device. Please help.”

The attacks started happening around the same time as a platform-wide purge campaign undertaken by X in April to remove fake, inactive, or spam accounts in bulk. The cleanup also led to the suspension and deletion of human-run alt accounts, including many used to privately curate niche porn, WIRED previously reported. “I'm not a fan of conspiracy theories, but it was convenient that they would do a hacking in the middle of a purge,” Bewley says, who believes the purge provided a good cover for the cybercriminals while also helping X scrub porn accounts.

Bewley had a verified account, which he continues to pay for, but says he received no benefit from X support in getting it back. Weeks following the hack, X responded to him and said they had no way to verify that he was the account’s true owner. X did not respond to a request for comment.

He also says he filed a police report in Palm Springs, where he lives, and a report with the FBI.

Mark, who relies on X to promote his movies, is fearful that another attack could happen, but notes, “I still haven’t fucking learned my lesson because I still don’t have two factor put on there. I’ll get around to it.”

While crypto scams have become increasingly common, Bewley says linking gay sex workers with MAGA feels especially targeted and malicious. He considers any association with right-wing ideology toxic. “If you ask me what the potential loss is, being associated with MAGA as a gay content creator is like saying you’re a Nazi. It’s a no-go territory. There’s no middle road,” Bewley says. “[The hacker] knew that would be distressing for me. And so that I would be more likely to want to shut it down.”

In May, all the posts were wiped from the account’s feed and the account went inactive. All that remains are the followers and the linktree to Bannon’s War Room platforms.

While phishing scams, and the pipeline to extort high value accounts, are not new, Rachel Tobac, CEO of data protection company SocialProof Security, thinks the problem could get worse with upcoming midterm elections. And while it’s not clear that was the case in the aforementioned hacks, she suspects cybercriminals are now using AI to scale their operations.

“If I were a cybercriminal and I also know that the right wing often has trouble with certain demographics, I am going to target accounts that they have trouble motivating,” she says. “I would use AI to determine who has a large network and following within those groups, take over those accounts with phishing, extort them, and if the extortion stops working, I’ll just stay dormant until it’s election season. It’s the perfect time to work with private online networks operated by right wing consulting organizations where stolen accounts can participate in political posting for compensation.”

Bewley has since created a new X page that has over 9,000 followers. He isn’t deterred by having to start over, but says the process is “like building a sand castle against the tide.”