https://github.com/legendaryangelist

https://github.com/legendaryangelist is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Heiner García. The report is dated 2025-08-02.

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2025-08-02 · last seen 2025-08-02

Source

  • Profiles the same post connects to Jackson Mori by a recycled bio line, a duplicated work history or a reused photograph, without claiming each is the same operator: an Upwork profile and a web3.career profile with the bio (the latter linking the DPRK-flagged vigorousdeveloper account), a Xing profile as Thomas Mullan and two X accounts with the same photograph, a Freelancer profile under the handle toptrust32, a Freelancer profile as Zhang J the post calls fraudulent and a Freelancermap profile it notes browsercookies reported as a DPRK IT worker, and the Anttoni Viitala identity (legendaryangelist on GitHub, Medium and Devpost) using the Jackson Mori image.
    heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García · under “Profiles sharing Jackson Mori's bio or photograph (Heiner García)” · published 2025-08-02 · pulled 2026-09-29

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8

Heiner García lists 30 other indicators in this source. 12 are shown, chosen across types.

All 31 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.