https://github.com/thinkingdev9
https://github.com/thinkingdev9 is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Heiner García.
The report is dated 2025-04-20.
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
Heiner García's article of 20 April 2025, read in full from its raw text, links a network of GitHub accounts to the Wagemole campaign through their handles, profile images, coordinated commits and requests to join community organisations, and closes with an Indicators of Compromise section listing eight email addresses and 214 GitHub accounts. The accounts here are that list, less the 49 it separately calls farmed, less those this index already holds, and less eleven that present as real developers. The body names the other values: the Telegram handles sasuke310 and spmoed and the sites sasuke.dev, spmoe.xyz and shiny-dev.com for the ShinySyntax and spmoe identity; motokimasuo.com for motokimasuo; iwakihiroto.info, the LinkedIn and Fiverr profiles under the name Hiroto Iwaki for mymiracle0118; the portfolio sites of vuedev2113 and OnlyForward0613 and the two X accounts OnlyForward0613 uses. The organisations and projects the accounts joined or targeted, among them dev-protocol, EddieHub, ProductShare DAO, TaraSwap and Stellar Foundation repositories, are named in the article as targets and are not carried.
medium.com/coinmonks/unmasking-suspicious-github-activity-the-wagemole-campaign-and-its-links-to-dprk-threat-actors-248e7901de38 — Heiner García
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.