audithunter821@gmail.com
audithunter821@gmail.com is an email address
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Narcass3 (@Narcass3) and Chollima Hunter.
The earliest of those reports is dated 2025-05-12 and the most recent 2026-09-24.
email address IT Worker Fraud CURATED
Sources
-
The first post is a bare list published under the word "btwz" with no operator named. The second post, from the same day, addresses the X accounts jeremymichael79 and Hakeohiratani directly and asks how Pyongyang is, which is the researcher treating both handles as DPRK operators. The two handles are recorded here on that basis. The list itself is still not split between them, because the posts do not say which account holds which identifier, and dividing it would be this site's inference rather than the researcher's. The first post also gives a web3.career handle, which has no indicator type in this repository. The address alexandersimmons824@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address audithunter821@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/Narcass3/status/1921805220478149068 — Narcass3 (@Narcass3) -
Found on 24 September 2026 by searching GitHub's commit index for every personal address this index transcribes from researchers' posts, and keeping the accounts whose own commits are signed with one. GitHub mints a noreply address from an account's immutable numeric id, in the form id+handle@users.noreply.github.com, so the former handles below are a matter of record. Counts of an account's own commits are over the 100 that GitHub's search returns for it. github.com/every821 is account id 174804603, created on 5 July 2024, bio I can do everything!, with 45 public repositories. All 100 of its own commits in GitHub's search are signed audithunter821@gmail.com, an address on the list Narcass3 published and then addressed to the X accounts jeremymichael79 and Hakeohiratani. The researcher did not split that list between the two, so no persona is attached here either.
github.com/every821 — Chollima Hunter
Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.