https://github.com/kstar0102

https://github.com/kstar0102 is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cookie Connoisseur (@browsercookies). The report is dated 2025-08-01.

The reporting files it under the persona kstar0102, alongside 7 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-08-01 · last seen 2025-08-01

Source

  • Transcribed by hand from the screenshot published in the cited post, read at full resolution rather than from a thumbnail. The post names this account as a follower of Oleksii9999. The screenshot shows the profile headline "Senior Mobile app | Web | API Developer" over the handle kstar0102, an affiliation of ICT Solutions, 112 repositories and 24 followers against 26 following. The same screenshot lists further accounts alongside Oleksii9999, but the post does not attribute those individually and at least one of them belongs to a well known legitimate developer, so none of them are recorded here. The address seniordev52@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/browsercookies/status/1951110041047855169 — Cookie Connoisseur (@browsercookies) · under “kstar0102” · published 2025-08-01 · pulled 2026-08-30

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created2020-06-13
Repositories103 original, 7 forked
History older than the account14 repositories: akatsuki (first commit 2019-08-24), chat_social_android_java (first commit 2019-06-23), cocokai (first commit 2016-09-11), Course_Booking_AndroidJava (first commit 2020-05-14), datingapp-hack (first commit 2019-11-25)
Commits copied into others' repositories0
Commit identities10 addresses, 7 names; up to 5 names on one address; up to 6 addresses under one name
Name then four digitskstar0102

Commit addresses this index holds

Follows these indexed accounts

Followed by these indexed accounts

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-06. 4 other commit addresses are held for review rather than listed. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Same persona record: kstar0102

Other identifiers the reporting files under the same persona; 6 of 7 are shown.

All 7 on the kstar0102 page

Cited by the same report: x.com/browsercookies/status/1951110041047855169

Cookie Connoisseur (@browsercookies) lists 6 other indicators in this source.

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.