https://github.com/bitfancy
https://github.com/bitfancy is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Cookie Connoisseur (@browsercookies).
The report is dated 2025-04-23.
The reporting files it under the persona Banana, alongside 10 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The researcher notes that the name Banana also appears in a daily work summary sheet among documents leaked from the group, which is why he singles this identity out; one of the attached images is that sheet, headed BANANA DAILY SUM-UP and logging job-application counts and working hours of ten to fifteen a day through January 2023. The GitHub account, address, Telegram handle and site are transcribed by hand from a second attached screenshot of the profile page, which carries the display name BitBanana over the handle BitFancy.
x.com/browsercookies/status/1915115006502568198 — Cookie Connoisseur (@browsercookies)
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Account analysis
| Account created | 2023-07-01 |
|---|---|
| Repositories | 95 original, 10 forked |
| History older than the account | 7 repositories: BitFancy/Bot-substrate-tip (first commit 2021-09-21), BitFancy/Decentralized-Voting (first commit 2020-03-30), BitFancy/Ruby-contract (first commit 2022-05-11), BitFancy/MulticallWrapper (first commit 2023-02-23), BitFancy/Solidity-Renpool (first commit 2021-06-04) |
| Commits copied into others' repositories | 0 |
| Commit identities | 2 addresses, 4 names; up to 3 names on one address; up to 3 addresses under one name |