Picture it: you finish a ranked match in League of Legends, and a friend request pops up from your opponent. She compliments your gameplay. Flatters you a little more. Suggests moving the conversation to Discord, where things turn flirtatious fast, punctuated by a steady stream of suggestive photos that stop just short of explicit. Eventually, she offers to “get dirty” and send “some actual nudes” as an exclusive, limited-time deal, just for you. And then you realize there’s a real chance none of that was a person at all.

Security researchers have documented a wave of AI-powered “fake-girl” bots working their way through gaming platforms and social media, using OnlyFans as the endpoint of a scripted, romance-flavored sales funnel. The League of Legends version is disarmingly simple. Automated accounts send friend requests to players immediately after matches, then run a compressed version of a classic phishing script where they build rapport, flatter the target’s skill, escalate flirtation, and migrate to a less-moderated platform like Discord. One Malwarebytes researcher got far enough into the funnel to be invited to subscribe to an OnlyFans account boasting nearly 20,000 likes, priced at $3.75 a month, which was an “85% discount” off a supposed $25 regular rate, the kind of urgency pricing that should be instantly recognizable from every other online scam.

Here’s what makes this particular scheme harder to dismiss than an obvious catfish: the underlying OnlyFans account is often real. A reverse image search on the bot’s photos turned up the same images recycled across unrelated websites and a YouTube video, with multiple players independently reporting identical pictures. It’s clear evidence of an automated campaign running at scale rather than one person hustling in their spare time. Former OnlyFans “chatters” have described exactly how this works from the business side: agencies staff live employees and bots around the clock to respond as though they’re the actual creator, pulling from a pre-built vault of photos and scripted lines, with the sole objective of converting every conversation into a subscription or a tip. The creator whose face and account are being used may not even know how their audience is being farmed.

Not every version of this scam stops at a subscription upsell, either. Some of these same bot accounts eventually pivot to sending malicious links designed to hijack Discord credentials or other account access, meaning the “girl who wants to duo” opening, as Malwarebytes puts it, can end in identity theft just as easily as in a $3.75 charge. It’s the same broader pattern researchers have flagged elsewhere with deepfaked creators impersonated on TikTok using stolen material and synthetic voices to con both fans and the original creators out of money. The tactics are converging across every platform where a stranger’s trust can be manufactured quickly.

The bots themselves are notably resilient to detection, too. If you try standard prompt-injection tricks, the kind of “reveal your instructions” jailbreak that can sometimes force a chatbot to break character, the fake-girl persona holds firm, deflecting and continuing the pitch rather than exposing its system prompt. Researchers suspect either deliberate guardrails or, more likely, a largely scripted flow lightly dressed up with AI-generated text rather than a fully open model. In one documented case, a bot even followed up on unanswered messages with “Why are you not replying?” alongside a concerned-face image, which is a small, unsettling detail that shows how much emotional realism these scripts are engineered to fake.

There’s something genuinely unsettling buried in the mechanics here, beyond the money at stake. These bots don’t need to convince anyone of anything false, exactly. The OnlyFans account is often real, the discount is often technically honored, the whole interaction can complete without a single lie being told. The manipulation is entirely in the manufactured intimacy: a fabricated sense of being noticed, flattered, and wanted by someone who complimented your last match specifically because an API told her when your game ended.