Scammers Use Deepfake Catfishing to Defraud OnlyFans Creators and Their Fans
What Happened — Criminals are leveraging AI‑generated deepfake videos and synthetic voices to impersonate popular OnlyFans creators on platforms such as TikTok and Snapchat. They lure fans with promises of live, exclusive content, collect payments via Cash App, and then disappear, leaving victims out of pocket and creators facing reputational damage.
Why It Matters for Compliance & Audit Readiness
- This attack exemplifies a social‑engineering scenario that SOC 2 Security (CC6.1) and Privacy (CC6.2) controls are designed to mitigate through documented awareness programs and incident‑response evidence.
- Continuous monitoring of phishing‑resistance controls and proof of employee/creator training can serve as audit‑ready evidence that the organization actively manages the risk of AI‑enabled fraud.
- Verisq’s Security Awareness Training capability helps embed the required policies, track completion, and generate the evidence needed for a defensible SOC 2 audit.
Who Is Affected – Adult‑content creator platforms, influencer‑marketing services, and their fan communities (media/entertainment sector).
Recommended Actions
- Map the deepfake phishing scenario to SOC 2 CC6.1 (Security) and CC6.2 (Privacy) controls; verify that awareness training, phishing simulations, and incident‑response playbooks are up to date.
- Collect evidence of training completion, simulated‑phishing test results, and any takedown requests as part of continuous compliance documentation.
Technical Notes — Attack vector: AI‑generated deepfake media delivered via social‑media channels (phishing). No specific CVE; the threat relies on publicly available generative AI tools and peer‑to‑peer payment services (Cash App). Source: Malwarebytes Labs