Mark Santiago
Mark Santiago is an alias
that 4 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Cookie Connoisseur (@browsercookies) and Chollima Hunter.
The earliest of those reports is dated 2025-08-01 and the most recent 2026-09-29.
The reporting files it under the persona Mark Santiago, alongside 14 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud CURATED
Sources
-
The post records the LinkedIn profile as already returning 404 at the time of writing.
x.com/browsercookies/status/1951099054861197523 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/marksantiago290 is account id 133281370, created on 11 May 2023, with 100 public repositories. Its noreply addresses name the handles marksantiago02, marksantiago2909, btc415 and its current one, so it is the account browsercookies names as github.com/marksantiago02 under Mark Santiago, renamed; marksantiago02 now returns not found. Its repositories hold 70 commits signed marksantiago0929@gmail.com and 66 signed alenschmitt415@gmail.com, and 42 signed stevenpiao0822@gmail.com, which the same researcher gives for Steven Leal.
github.com/marksantiago290 — Chollima Hunter -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 1 commit signed marksantiago0929@gmail.com, an address browsercookies publishes for this persona, to github.com/imthegr8t1, account id 190365500, created on 2 December 2024, with 24 public repositories. GitHub attributes 100 commits signed alenschmitt415@gmail.com, an address browsercookies publishes for this persona, to the login luckymark228312, which no longer resolves.
github.com/imthegr8t1 — Chollima Hunter -
Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (marksantiago290, marksantiago02) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
github.com/marksantiago290/Ethereum-MEV-BOT/blob/db787bfec2aff77f6f572f5d6a5aec4b2abadae9/README.md — Chollima Hunter
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.
Related indicators
Same persona record: Mark Santiago
All 14 on the Mark Santiago page
Cited by the same report: x.com/browsercookies/status/1951099054861197523
All 7 indicators from this source
Cited by the same report: github.com/marksantiago290
All 4 indicators from this source