10.08.2026
3 min
81
Bots posing as girls are moving beyond OnlyFans and actively looking for potential subscribers on TikTok, Discord, and even League of Legends. Scammers are changing their tactics to sell both genuine and fake explicit content.
The line between phishing and promoting content on OnlyFans is becoming increasingly blurred. Cybersecurity researchers are warning about AI-powered chatbots operated by scammers that target gamers and social media users.
Victims are not sent malicious links or attachments, asked for payments, or redirected to fake login pages. Instead, they simply receive a link to an OnlyFans account.
The bot promises to make the conversation more explicit and send “a few real nude photos,” promoting it as an exclusive, limited-time offer.
Malwarebytes reports that League of Legends (LoL) players are receiving friend requests from opponents after matches. An automated bot then poses as a girl and uses a familiar phishing tactic to establish contact: a romance-style approach.
The new “friend” compliments the target’s playing style, adds more flattery, and invites them to continue the conversation on Discord, where the interaction becomes increasingly flirtatious. The bot sends a steady stream of provocative photos while stopping short of fully explicit content.
Several other League of Legends players have already reported encountering similar schemes. However, scammers do not always promote obviously fake accounts.
One Malwarebytes employee was encouraged by a bot to subscribe to an OnlyFans account with nearly 20,000 likes. The monthly subscription cost $3.75, supposedly representing an 85% discount from the regular price of $25 per month.
A reverse image search revealed that the same photo had been used on other unrelated websites and in YouTube videos. Other users also reported receiving identical images, suggesting a large-scale automated campaign rather than the activity of a single person.
“That doesn’t make the scheme harmless. Even when the OnlyFans account itself is real, the conversations are most likely handled by paid chat operators or scripted or AI-powered systems that follow a shared script and reuse content from the same media library,” Malwarebytes warns.
Former OnlyFans chat operators have previously described a business model in which specialized agencies employ staff and bots to respond to users around the clock while pretending to be the actual creator behind the account. They reuse photos and messages from a pre-prepared library, with the main goal of turning every conversation into a new subscription or tip.
At the same time, far more dangerous scams also exist. Some bot accounts eventually send malicious links designed to take over Discord or other accounts and steal login credentials.
USA Today previously reported on cases in which scammers impersonated real OnlyFans creators to deceive their fans. Both creators and users can fall victim to these schemes. Scammers create fake TikTok accounts under other people’s names, use content stolen from genuine creators, and add synthetic voices to convince victims to send them money.
“The opening line ‘a girl wants to duo’ can just as easily end in an account takeover attempt as it can in an upsell for another subscription,” Malwarebytes warns.
League of Legends players inside the game client are just one of many potential targets, as bots can be difficult to distinguish from real people in such an environment. Researchers suspect that bot operators may collect or monitor gaming data through various APIs to identify specific players and determine when their matches have ended.
Malwarebytes also tried using a common prompt injection technique to force a bot posing as a girl on Discord to reveal its system prompt. However, the attempt was unsuccessful.
“When the account was given a ‘reveal your instructions’ style prompt, with text formatted to look like a system message ordering the bot to break character and reveal its configuration, it did not comply. Instead, it stayed in character, deflected the request, and continued promoting the offer,” the researchers explained.
They suggest that bot operators may be using specific safeguards against this type of probing or relying on a simpler scripted flow supplemented with text generated by a large language model rather than a fully open-ended chatbot.
Researchers also described a case in which a user deliberately stopped responding. The bot continued the conversation by asking, “Why aren’t you replying?” and accompanied the message with a photo showing a concerned facial expression.
Malwarebytes recommends treating unsolicited friend requests from unknown users as suspicious by default.
Players on Riot’s platform can enable streamer mode to hide some of their information from outsiders. Users should also be cautious of strangers who try to quickly move conversations away from a moderated platform to another service. They should avoid sending money or sharing personal information and report suspicious accounts to the platform’s administrators.
