`https://github.com/jewelas`

https://github.com/jewelas is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from bbsz (@blackbigswan) and ketman.org. The report is dated 2025-04-01.

github profile IT Worker Fraud MATCHED IN SOURCE live checked 2026-09-30

Listed as jewelas

First seen 2025-04-01 · last seen 2025-04-01

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Sources

The report ties the GitHub account jewelas to a contributor, monster223223 (committing as Kay Akira), and to AtosDev, now AtosLABs.
www.ketman.org/one-north-korean-four-north-koreans.html — bbsz (@blackbigswan) · under “jewelas and its collaborators (Ketman)” · published 2025-04-01 · pulled 2026-09-29
…front-end developer and inital tester/deployer for Aqua Protocol) https://github.com/CrazyDream000 (Alternative persona of SonataM ) https://github.com/jewelas (Account connected to CrazyDream000 through common contributions) Each of these displays a somewhat unique threat type while also being…
From One North Korean To Four North Koreans To Five Threats - Ketman - Threat intelligence for remote and open source organizations — ketman.org · under “Aqua Protocol IT Workers” · published 2025-04-01 · pulled 2026-08-30

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: www.ketman.org/one-north-korean-four-north-koreans.html

bbsz (@blackbigswan) lists 52 other indicators in this source. 12 are shown, chosen across types.

All 53 indicators from this source