https://github.com/uniwaydev
https://github.com/uniwaydev is a GitHub account
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Heiner García and Mees van Wickeren (Medium).
The earliest of those reports is dated 2025-04-20 and the most recent 2026-01-23.
github profile IT Worker Fraud RESEARCHER POST live
live
Sources
-
Heiner García's article of 20 April 2025, read in full from its raw text, links a network of GitHub accounts to the Wagemole campaign through their handles, profile images, coordinated commits and requests to join community organisations, and closes with an Indicators of Compromise section listing eight email addresses and 214 GitHub accounts. The accounts here are that list, less the 49 it separately calls farmed, less those this index already holds, and less eleven that present as real developers. The body names the other values: the Telegram handles sasuke310 and spmoed and the sites sasuke.dev, spmoe.xyz and shiny-dev.com for the ShinySyntax and spmoe identity; motokimasuo.com for motokimasuo; iwakihiroto.info, the LinkedIn and Fiverr profiles under the name Hiroto Iwaki for mymiracle0118; the portfolio sites of vuedev2113 and OnlyForward0613 and the two X accounts OnlyForward0613 uses. The organisations and projects the accounts joined or targeted, among them dev-protocol, EddieHub, ProductShare DAO, TaraSwap and Stellar Foundation repositories, are named in the article as targets and are not carried.
medium.com/coinmonks/unmasking-suspicious-github-activity-the-wagemole-campaign-and-its-links-to-dprk-threat-actors-248e7901de38 — Heiner García -
Transcribed by hand on 27 September 2026 from a post the scraper cannot read because Medium answers it with a bot check. The post walks a cluster of GitHub accounts that follow and star one another. It states that techlover9922, received from another researcher, was verified by the author as a North Korean fake profile; the rest it calls suspicious, and it says no malware delivery was found. Only four of the roughly thirty accounts it names are carried here: techlover9922 on the author's own verification, and geektalent1010, DevHawkNov and uniwaydev because their follow graphs, checked on 27 September 2026, connect them to accounts this site already indexes from other reporting (geektalent1010 follows kamaalsultan and supercomet329 and is followed by uniwaydev and bitcrusher1023; DevHawkNov is followed by forest410, popstar7 and thinkingdev9 and follows dreamsoft07). The others rest on the post's graph reasoning alone, several present as real developers, and one X account the post names is the person being impersonated, so they are not carried.
medium.com/@meeswicky1100/the-web-of-north-korean-fake-profiles-3e04d8dcd1af — Mees van Wickeren (Medium)
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.
Related indicators
Cited by the same report: medium.com/coinmonks/unmasking-suspicious-github-activity-the-wagemole-campaign-and-its-links-to-dprk-threat-actors-248e7901de38
All 148 indicators from this source