youngmobileguy@gmail.com

youngmobileguy@gmail.com is an email address that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cookie Connoisseur (@browsercookies). The report is dated 2025-06-06.

email address IT Worker Fraud RESEARCHER POST

First seen 2025-06-06 · last seen 2025-06-06

Source

  • A three-post thread opening "Just a DPRK boyz (same boy) GitHub accts", followed by two posts reading "Few mo". Every account is transcribed by hand from the twelve attached profile captures. The researcher states that all twelve belong to one operator but never names that operator, so they are recorded as an attributed set without a persona rather than under a name this site would have had to invent. Two of the captures corroborate the grouping from inside: the AngelCat0990 account's only repository is a fork of one belonging to 3D-Dev, and the proactive-dev and prodev90 accounts present under near-identical display names. The address is transcribed from the Anton-Dev97 profile, whose biography reads "Senior Software Developer and Hacker Team Leader" followed by it. One of the twelve has since changed hands. The 3D-Dev login was checked on 1 September 2026 and resolves to an account created on 28 October 2025 holding no repositories and no followers, where the capture in the cited post shows 157 repositories and 1,300 followers in June 2025. The original was deleted and the name taken by someone else, so whoever holds it now has no connection to anything here; the identifier is kept because the post published it, not as a pointer to the account answering today. The address youngmobileguy@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address suko.m@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address proactive.d20@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address ts199111st@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/browsercookies/status/1930806222372114436 — Cookie Connoisseur (@browsercookies) · under “GitHub accounts browsercookies attributes to a single unnamed operator” · published 2025-06-06 · pulled 2026-08-30

Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.

Related indicators

Cited by the same report: x.com/browsercookies/status/1930806222372114436

Cookie Connoisseur (@browsercookies) lists 6 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.