Patrick Bewley’s X feed was normally filled with posts about leather three-ways and clips of pool-house erotica, serving as a primary marketing engine for his career in the adult film industry. The gay OnlyFans star, known professionally as Daddy Patrick, had made the unconventional decision to enter the adult industry at age 60. His late-career pivot proved remarkably successful; in under two years, his followers on X (formerly Twitter) swelled to 132,000, providing him with the digital footprint necessary to secure high-profile collaborations and maintain a steady stream of revenue for his OnlyFans page. However, in April 2024, the account’s content underwent a jarring transformation. Bewley’s feed, once a hub for niche adult entertainment, suddenly became a megaphone for partisan politics and MAGA-aligned messaging. Posts began appearing that claimed, “President Trump stuns the World announcing America has more oil than the next two largest Oil economies COMBINED,” marking a complete departure from Bewley’s established brand and personal politics.
The shift was not a change of heart by the creator but the result of a sophisticated and targeted hijacking. Bewley is one of several high-profile gay OnlyFans creators who have recently been targeted by crypto-based extortionists on X. These attackers utilize social engineering and phishing tactics to seize control of high-follower accounts, subsequently attempting to extort thousands of dollars from the original owners. When creators refuse to pay the ransom, the hackers often repurpose the accounts to spread cryptocurrency scams or, as in Bewley’s case, aggressive political propaganda.
The Anatomy of a Phishing Attack
The breach of Bewley’s account began on April 9, 2024, through a deceptive Direct Message (DM) from a trusted source. Bewley received a message from a professional acquaintance, the porn director and editor Jasun Mark. Unbeknownst to Bewley at the time, Mark’s account had already been compromised by the same group of attackers. The message appeared innocuous, asking Bewley to nominate Mark for an industry award. Because the request aligned with the professional norms of the adult industry—where peer nominations for awards like the AVN or XBIZ are common—Bewley did not suspect foul play. “It did sound kind of like something he would do,” Bewley noted in retrospect.
The DM contained a link that redirected Bewley to a fraudulent landing page designed to mimic the X login interface. When Bewley entered his credentials, the attackers captured his login information in real-time. Although Bewley initially believed the login attempt had failed because the page did not redirect him correctly, the damage was already done. Within hours, the attackers had bypassed security measures and gained full access to the account.
By the time Mark was able to notify his contacts that his own account had been stolen, the hijackers had already moved to secure Bewley’s profile. They immediately changed the account’s recovery name, telephone number, and associated email address, effectively locking Bewley out. The account handle, originally a recognizable brand name for the creator, was changed first to @DADDYPATRIOzvu on April 9, and then to @Fatherokdwcjo63 on April 10. This sequence of rapid changes is a common tactic used by hijackers to obscure the account from its original followers and prevent automated recovery systems from identifying the breach.
From Extortion to Propaganda: A Timeline of the Hijack
Following the initial takeover, the situation escalated from a simple account theft to an active extortion attempt. Bewley’s partner, Jerry Burt, attempted to intervene by reporting the theft to X from his personal account and engaging with the hijacker through the compromised profile’s messaging system. The response from the attacker was blunt and transactional.
On April 16, exactly one week after the initial breach, the hijacked account posted an image of Donald Trump with a text overlay reading, “GOOD MORNING, I’M STILL YOUR PRESIDENT.” When Burt reached out to ask how the account could be returned, the hijacker replied in a series of messages: “Just pay for it. That’s all. You want this account or not? Ain’t joking man.” The ransom was set at $2,000, specifically requested in GAT crypto, a relatively obscure digital asset.
When Bewley and Burt refused to comply with the demands, the attackers expanded their targets. They contacted Bewley’s employer, Ducati Studios Network, a prominent gay porn production company where Bewley had recently been appointed Chief Marketing Officer (CMO). The hijackers increased their demand to $3,000 in cryptocurrency, attempting to leverage the company’s professional interest in Bewley’s brand to secure a payout.
After two weeks of unsuccessful negotiations, the attackers pivoted their strategy. Instead of merely holding the account hostage, they began utilizing its 132,000-follower reach to amplify political content. The account’s banner and avatar were replaced with images of Steve Bannon, the former White House strategist and host of the War Room podcast. The profile began including links to Bannon’s TikTok, Telegram, and official merchandise store. According to Burt, the account entered “crazy MAGA mode,” reposting 20 to 30 posts daily from extremist Republican pages and accounts like @MAGAVoice, which describes itself as a “Proud Patriot” and “Pro Elon Musk” entity dedicated to “taking back OUR country.”
The Economic Impact on Adult Creators
The loss of an X account is more than a personal inconvenience for individuals in the adult industry; it is a significant blow to their professional livelihood. In the modern adult entertainment ecosystem, X serves as the primary "top-of-funnel" marketing platform. Unlike Instagram or TikTok, which have strict "no-nudity" policies and frequently shadowban adult-adjacent content, X has historically been more permissive toward adult creators.
A high follower count on X provides what Bewley describes as “automatic credibility.” In an industry where collaborations (often referred to as "collabs") are the primary way to grow a brand, a creator’s follower count acts as a social currency and a measure of market value. "In a way, it dictates who will want to work with you," Bewley explained. "It is the one platform people look at as the measure of where your standing is, almost like a ranking."
When a creator with over 100,000 followers loses their account, they lose years of networking, thousands of dollars in potential redirect traffic to subscription sites like OnlyFans, and the trust of their audience. For Bewley, the hijacking not only silenced his marketing voice but also associated his professional brand with political ideologies that may alienate his core demographic, potentially causing long-term damage to his reputation and earning potential.
Broader Implications and the Role of X Corp
The targeting of gay adult creators appears to be part of a broader trend of "account flipping" on X. Cybersecurity analysts have noted that accounts with high engagement rates and established follower bases are highly sought after by "influence farms" and crypto-scammers. By hijacking an established account, bad actors can bypass the "new account" filters that X uses to catch bots, allowing them to spread misinformation or promotional content with a veneer of legitimacy.
The choice of MAGA-centric propaganda in the Bewley case is particularly notable. Analysts suggest that such content is often used to maintain engagement levels on stolen accounts, as political posts frequently generate high volumes of interactions from both supporters and detractors. This engagement keeps the account active and visible in X’s algorithmic feeds, making it more valuable if the hacker eventually decides to sell the handle to another party.
The incident also highlights ongoing concerns regarding X’s customer support and security infrastructure. Since the acquisition of the platform by Elon Musk in 2022 and the subsequent layoffs that decimated the company’s trust and safety teams, many users have reported extreme difficulty in recovering stolen accounts. The automated systems often fail to recognize the nuances of social engineering attacks, and the lack of human support leaves victims like Bewley with little recourse. Despite numerous reports from Bewley, his partner, and his employer, the account remained in the hands of the hijackers for weeks, continuing to broadcast content diametrically opposed to the original owner’s identity.
Cybersecurity Lessons for Public Figures
The Bewley hijacking serves as a cautionary tale regarding the evolution of phishing. Traditional phishing often relied on generic emails from "banks" or "shipping companies." Modern social engineering, however, is highly personalized. By compromising one account within a specific professional niche, attackers can "lever up," using the trust established between colleagues to claim more victims.
To mitigate these risks, cybersecurity experts recommend several critical steps for high-profile users:
- Hardware-Based 2FA: Moving beyond SMS-based two-factor authentication to physical security keys (like YubiKeys) can prevent hijackers from gaining access even if they have the password.
- Out-of-Band Verification: If a colleague or friend sends a link or a request for a "nomination" or "vote" via DM, users should verify the request through a different communication channel, such as a text message or phone call.
- Dedicated Business Devices: Using a separate device for social media management can reduce the risk of cross-contamination from malicious links.
As of late April, Bewley’s original account remained a vessel for political messaging and crypto-links, a stark reminder of the vulnerability of digital identities in an era of automated platforms and sophisticated cyber-extortion. For Bewley, the focus has shifted from recovery to rebuilding, a daunting task in an industry where digital presence is synonymous with professional survival.
