`cccodechef@gmail.com`

cccodechef@gmail.com is an email address that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cookie Connoisseur (@browsercookies) and ZEUS-DEV-919 working document. The reports are dated 2025-04-21.

email address IT Worker Fraud RESEARCHER POST

Listed under Takuma Miyake, ZEUS.

First seen 2025-04-21 · last seen 2025-04-21

Sources

The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/browsercookies/status/1914451502057529606 — Cookie Connoisseur (@browsercookies) · under “ZEUS / Tony Choi” · published 2025-04-21 · pulled 2026-08-30
Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. Eight names in that table share one address and one Skype identifier, which is why they are one entry here rather than eight. The telephone number is the one the table gives against the Brian Cook row, on a line that otherwise carries the same Skype identifier as the rest.
docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Takuma Miyake / Lionel Grace / Carter Walker / Michael Adams / Liam Lio / Angel Hernandez / Alfred Waris / Brian Cook” · pulled 2026-09-09

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Same persona record: Takuma Miyake

Other identifiers the reporting files under the same persona; 4 of 10 are shown.

All 10 on the Takuma Miyake page

Same persona record: ZEUS

Other identifiers the reporting files under the same persona; 4 of 12 are shown.

All 12 on the ZEUS page

Cited by the same report: x.com/browsercookies/status/1914451502057529606

Cookie Connoisseur (@browsercookies) lists 3 other indicators in this source. 2 are shown, chosen across types.

All 4 indicators from this source

Cited by the same report: docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit

ZEUS-DEV-919 working document lists 51 other indicators in this source. 2 are shown, chosen across types.

All 52 indicators from this source