May Lee
May Lee is an alias
that 4 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from meow mfer (@meow_mfer) and Chollima Hunter.
The reports are dated 2026-04-17.
The reporting files it under the persona May Lee, alongside 6 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud CURATED
Sources
-
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven: commits under two names, May Lee and JinHai, from one address.
x.com/meow_mfer/status/2045104494862889433 — meow mfer (@meow_mfer) -
Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under may79, a login the index already carries for this persona on another platform. The profile gives a member-since date of 16 August 2021. It displays the name May Lee, the same name the reporting already gives. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.
gitlab.com/may79 — Chollima Hunter -
Found on 13 September 2026 by probing every account handle this site already holds for this operator against dev.to, and read from the profile's own public API. An account exists under may79, a login the index already carries for this persona on another platform. It gives a joined date of Aug 26, 2021. It displays the name May Lee, the same name the reporting already gives. The profile links a GitHub account, may79. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/may79 — Chollima Hunter -
Found on 17 September 2026 by asking Hugging Face whether an account exists under may79, one of the logins the registry already holds for this operator, and read from the profile cited. The account states a display name of nena. The display name is kept here rather than as an alias, because it restates the handle, describes the work, or repeats what this operator is already called. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
huggingface.co/may79 — Chollima Hunter
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.