Chollima Hunter

← Remote Workers

https://github.com/jamesh0807

https://github.com/jamesh0807 is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from meow mfer (@meow_mfer). The report is dated 2026-04-17.

The reporting files it under the persona James Honeycutt, alongside 9 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post seven gives the profile as James Honeycutt of Jacksonville, Florida, while the commits are authored as KevinGrant-dev with this address and the account holds a portfolio repository under the Kevin Grant name; the previous username was KevinGrant-dev. Post nine records the account created on 7 March 2022 within minutes of MBenz12.
    x.com/meow_mfer/status/2045108002836099351 — meow mfer (@meow_mfer) · under “James Honeycutt / Kevin Grant” · published 2026-04-17 · pulled 2026-08-30

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created2022-03-07
Repositories27 original, 1 forked
History older than the account0 repositories
Commits copied into others' repositories0
Commit identities0 addresses, 0 names
Name then four digitsjamesh0807

Follows these indexed accounts

Followed by these indexed accounts

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-04. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Same persona record: James Honeycutt

Other identifiers the reporting files under the same persona; 8 of 9 are shown.

All 9 on the James Honeycutt page

Cited by the same report: x.com/meow_mfer/status/2045108002836099351

meow mfer (@meow_mfer) lists 5 other indicators in this source. 4 are shown, chosen across types.

All 6 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.