Benjamin

Benjamin is an alias that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cookie Connoisseur (@browsercookies) and aptwhatnow (@aptwhatnow). The earliest of those reports is dated 2025-04-18 and the most recent 2025-04-23.

alias IT Worker Fraud RESEARCHER POST

Listed under Benjamin, Peter Piao.

First seen 2025-04-18 · last seen 2025-04-23

Sources

  • The post states that this operator recruits others to carry out work for him and so scale the operation. The alias Benjmain Stewart is transcribed as the post spells it. Two follow-up posts in the same thread quote his recruiting message, sent to people listed on virtualstaff.ph as a Senior Software Developer from Singapore seeking a virtual assistant, and the arrangement offered: payments from customers land in the recruit's own account and card, and the recruit forwards 90 percent of the income to him. Neither post carries a further typable indicator.
    x.com/browsercookies/status/1915147733058412753 — Cookie Connoisseur (@browsercookies) · under “Peter Piao / Benjmain Stewart / Benjamin / Richard Moore / Aloukik / Deng / Vadim Titko / Parithong / Grigory Kotov” · published 2025-04-23 · pulled 2026-08-30
  • The second identity in the same post, given only as "a Benjamin", which the researcher says was also hired at an artificial intelligence company through the same Florida staffing agent. A given name on its own settles nothing and is recorded as exactly that.
    x.com/aptwhatnow/status/1913291827278414205 — aptwhatnow (@aptwhatnow) · under “Benjamin” · published 2025-04-18 · pulled 2026-08-30

Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.

Related indicators

Same persona record: Peter Piao

Other identifiers the reporting files under the same persona; 8 of 9 are shown.

All 9 on the Peter Piao page

Cited by the same report: x.com/browsercookies/status/1915147733058412753

Cookie Connoisseur (@browsercookies) lists 9 other indicators in this source. 1 are shown, chosen across types.

All 10 indicators from this source

Cited by the same report: x.com/aptwhatnow/status/1913291827278414205

aptwhatnow (@aptwhatnow) lists 3 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.