`https://github.com/cedev935`

https://github.com/cedev935 is a GitHub account that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Heiner García and North Scan. The earliest of those reports is dated 2025-02-26 and the most recent 2026-10-18.

github profile IT Worker Fraud MATCHED IN SOURCE live checked 2026-09-30

Listed as cedev935

First seen 2025-02-26 · last seen 2026-10-18

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Sources

Heiner García's article names a network of GitHub accounts it calls the SuperStar Campaign, after the words Super, Star and Dev that recur in the handles and a SuperStar user name on one member's machine, and places it with the Contagious Interview and Wagemole activity Unit 42 reports. The network centres on Finalgoal231, a GitHub organisation of eighteen members, most of which the article judges to be fake profiles, whose discussions show members starring one another's work, coordinating through Discord and rewriting commit histories to change addresses. It shows popstar7 renaming oddcommitking to Luis96920 in a pull request, and xaramore, a follower hub from the researcher's earlier work, now deleted. The first thirty-two accounts are the article's own closing list of suspicious accounts, less the two held back below, and the article describes that list as a sample of a larger confidential set; the last four, xaramore, Finalgoal231, oddcommitking and e-nitram, are named in its body. When read on 24 September 2026, deepsea514, GoodLuck0129 and xaramore no longer resolved, and kingp08 and Topstar88 resolved to accounts created in April 2026 and July 2025, after the article, so those two handles now belong to different holders than the ones it named.
www.linkedin.com/pulse/reviewing-activity-github-accounts-linked-dprk-heiner-garc%C3%ADa-p%C3%A9rez-xpkae/ — Heiner García · under “GitHub accounts in the SuperStar Campaign network (Heiner García)” · published 2025-02-26 · pulled 2026-08-30
…s/react/issues/190 URL:https//github.com/dreamcoder75 URL:https//github.com/AIDevMonster URL:https//github.com/whiteghostDev URL:https//github.com/cedev935 URL:https//github.com/green52199 URL:https//github.com/CryptoTop1111 URL:https//github.com/secretsuperstar1109 URL:https//github.com/ch…
The GitHub Diaries of DPRK IT Workers — North Scan · under “Indicators of Compromise” · pulled 2026-09-12

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created	2023-07-26
Repositories	90 original, 34 forked
History older than the account	61 repositories: `adonis0302/OpenChat` (first commit 2022-06-24), `AI-python` (first commit 2021-11-01), `android-chat` (first commit 2016-02-25), `appwrite` (first commit 2020-09-23), `bettingsite` (first commit 2022-08-22)
Commits copied into others' repositories	0
Commit identities	1 address, 4 names; up to 3 names on one address; up to 2 addresses under one name

Follows these indexed accounts

Followed by these indexed accounts

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-31. 1 other commit address is held for review rather than listed. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Cited by the same report: www.linkedin.com/pulse/reviewing-activity-github-accounts-linked-dprk-heiner-garc%C3%ADa-p%C3%A9rez-xpkae/

Heiner García lists 35 other indicators in this source. 7 are shown, chosen across types.

All 36 indicators from this source

Cited by the same report: The GitHub Diaries of DPRK IT Workers

North Scan lists 27 other indicators in this source. 5 are shown, chosen across types.

All 28 indicators from this source