Chollima Hunter

← Remote Workers

https://github.com/guangyang-sunlight

https://github.com/guangyang-sunlight is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Cookie Connoisseur (@browsercookies). The report is dated 2025-07-23.

The reporting files it under the persona Chae Gwang Jin, alongside 9 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-07-23 · last seen 2025-07-23

Source

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created2025-05-19
Repositories52 original, 0 forked
History older than the account8 repositories: Guangyang-Sunlight/company_info (first commit 2022-09-02), Guangyang-Sunlight/online-movie-booking (first commit 2020-09-02), Guangyang-Sunlight/checkout-liquid-po-box-validator (first commit 2020-11-02), Guangyang-Sunlight/HomeLuxe_app (first commit 2020-07-02), Guangyang-Sunlight/Django_pro (first commit 2020-09-02)
Commits copied into others' repositories0
Commit identities1 address, 4 names; up to 4 names on one address

Commit addresses this index holds

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-03. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Same persona record: Chae Gwang Jin

Other identifiers the reporting files under the same persona; 8 of 9 are shown.

All 9 on the Chae Gwang Jin page

Cited by the same report: x.com/browsercookies/status/1947820856459330016

Cookie Connoisseur (@browsercookies) lists 3 other indicators in this source. 1 are shown, chosen across types.

All 4 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.