https://github.com/cuda-toolkit
https://github.com/cuda-toolkit is a GitHub account
that one published source reports
in connection with Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from meow mfer (@meow_mfer).
The report is dated 2026-05-18.
The reporting files it under the persona cuda-toolkit. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile Contagious Interview RESEARCHER POST removed
removed
Source
-
Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This account, deleted by the time the article was published, hosted malware payloads as GitHub Gists dressed up as CUDA toolkit and PyTorch simulation scripts, using the Gist service itself as the delivery channel. It is recorded because the handle is the only durable identifier the article gives for that delivery method, not because the account is expected to resolve.
x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer)
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.