Taro Aikuchi
Taro Aikuchi is an alias
that 4 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from tanuki42 (@tanuki42_), meow mfer (@meow_mfer) and Chollima Hunter.
The earliest of those reports is dated 2026-04-14 and the most recent 2026-09-20.
The reporting files it under the persona Taro Aikuchi, alongside 24 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud CURATED
Sources
-
Applicant who approached the researcher for a remote engineering role and was assessed by them as a DPRK IT worker. The researcher reports a LinkedIn account created in 2025 with no photograph, an AI-generated CV listing a degree that does not exist and an email address different from the one the application came from, a Telegram account posting to recruit facilitators willing to supply Upwork accounts and stand in for KYC, a GitHub account created in 2025 whose commits carry a third address and among whose repository contributors are accounts the researcher had previously encountered, a connection to the interview from an AstrillVPN address, and a Japanese My Number card the researcher and a consulted specialist assessed as a forgery. Running the three addresses through an OSINT service returned accounts registered under four further names and locations inconsistent with a Japanese national. Both the LinkedIn and the GitHub account were deleted after the interview. The post that carries that OSINT result was itself never cited here until 16 September 2026, and two of the accounts it shows are typeable. The LinkedIn card for Pavlo Polishichuk gives the account name pavlo-polishichuk-b68920364 and a biography in Ukrainian reading Posada Full-stack Developer u Freelancer; the post's own summary places that identity in Poland while the card places it in Shpola, Cherkasy, in Ukraine, and the card is what is recorded. The John Ruff identity is a resume hosted on bubble.io whose indexed preview carries a United States telephone number beside the highgoal215 address already held here, which is what ties the number to this persona rather than to a separate one. The Master Dev identity is a Microsoft account created on 3 November 2025 and registered to France, with only a masked telephone number shown.
x.com/tanuki42_/status/2044106347017539686 — tanuki42 (@tanuki42_) -
A ten-part thread responding to tanuki42's work on this persona, of which parts two, four and nine carry the indicators. It corroborates six values this site already held from tanuki42 independently, including the address, the telephone number, the cryptotrading2150 Telegram account and the deleted 0xbomb215 GitHub account, and adds the six recorded here. The link the thread rests on is a commit trailer in the repository miracle709/Robo-Apply, where a commit authored by 0xbomb215 carries a co-author line naming xsen215 at narutodev215@outlook.com; that is a checkable artefact rather than an assertion, and it is why these identifiers are recorded while the thread's database-only claims are not. The thread also states that 0xbomb215 has since been deleted. Parts three, five, seven and nine continue past the text this pass was able to capture before X throttled the session, so this entry is what those posts state up to that point rather than the whole of them. The address miracle7091@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/meow_mfer/status/2044585689292169292 — meow mfer (@meow_mfer) -
Found on 17 September 2026 by asking Docker Hub whether an account exists under highgoal215, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a registration date of 15 August 2025 and a display name of High Goal. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
hub.docker.com/u/highgoal215 — Chollima Hunter -
Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/HighGoal1991, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: iuri39493@gmail.com authored 488 commits across 7 of its repositories, commits as "HighGoal1991". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.
github.com/HighGoal1991 — Chollima Hunter
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.
Related indicators
Same persona record: Taro Aikuchi
All 24 on the Taro Aikuchi page