https://github.com/zeus-dev919
https://github.com/zeus-dev919 is a GitHub account
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Cookie Connoisseur (@browsercookies) and ZEUS-DEV-919 working document.
The reports are dated 2025-04-21.
github profile IT Worker Fraud RESEARCHER POST removed
Listed under ZEUS, zeus-dev919.
removed
Sources
-
The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/browsercookies/status/1914451502057529606 — Cookie Connoisseur (@browsercookies) -
Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. This is the account the whole compilation is built around. The document reads its repositories as publishing the personas, cover letters, resumes and operating procedures the rest of the table is drawn from, and notes the SuperStar moniker as one it says recurs across DPRK accounts. The Drive folder it names is attributed to the address here.
docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.