https://github.com/kevin-dev888
https://github.com/kevin-dev888 is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Cookie Connoisseur (@browsercookies).
The report is dated 2025-06-06.
The reporting files it under the persona 888 cluster, alongside 10 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The researcher groups these accounts together as "all them 888 accts", which is the only name given for the operator, so the shared 888 marker is used as the label here. A second post the same day greets five X accounts as DPRK; only the two carrying the 888 marker are recorded against this cluster, because that post addresses them in the plural without saying they are one person.
x.com/browsercookies/status/1930813301828775996 — Cookie Connoisseur (@browsercookies)
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Account analysis
| Account created | 2021-11-26 |
|---|---|
| Repositories | 1 original, 0 forked |
| History older than the account | 0 repositories |
| Commits copied into others' repositories | 0 |
| Commit identities | 0 addresses, 1 name |
Related indicators
Same persona record: 888 cluster
All 10 on the 888 cluster page