https://github.com/alexandrs888
https://github.com/alexandrs888 is a GitHub account
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Cookie Connoisseur (@browsercookies).
The reports are dated 2025-06-06.
The reporting files it under the persona 888 cluster, alongside 10 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker Fraud RESEARCHER POST live
live
Sources
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies) -
A three-post thread opening "Just a DPRK boyz (same boy) GitHub accts", followed by two posts reading "Few mo". Every account is transcribed by hand from the twelve attached profile captures. The researcher states that all twelve belong to one operator but never names that operator, so they are recorded as an attributed set without a persona rather than under a name this site would have had to invent. Two of the captures corroborate the grouping from inside: the AngelCat0990 account's only repository is a fork of one belonging to 3D-Dev, and the proactive-dev and prodev90 accounts present under near-identical display names. The address is transcribed from the Anton-Dev97 profile, whose biography reads "Senior Software Developer and Hacker Team Leader" followed by it. One of the twelve has since changed hands. The 3D-Dev login was checked on 1 September 2026 and resolves to an account created on 28 October 2025 holding no repositories and no followers, where the capture in the cited post shows 157 repositories and 1,300 followers in June 2025. The original was deleted and the name taken by someone else, so whoever holds it now has no connection to anything here; the identifier is kept because the post published it, not as a pointer to the account answering today. The address youngmobileguy@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address suko.m@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address proactive.d20@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The address ts199111st@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/browsercookies/status/1930806306287612005 — Cookie Connoisseur (@browsercookies)
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Account analysis
| Account created | 2020-01-21 |
|---|---|
| Repositories | 0 original, 0 forked |
| History older than the account | 0 repositories |
| Commits copied into others' repositories | 0 |
| Commit identities | 0 addresses, 0 names |
Related indicators
Same persona record: 888 cluster
All 10 on the 888 cluster page
Cited by the same report: x.com/browsercookies/status/1930813301828775996
All 10 indicators from this source