https://github.com/winner950617
https://github.com/winner950617 is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Cookie Connoisseur (@browsercookies).
The report is dated 2025-07-23.
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The post names DevSharp-Tech, Stellar-1117 and GoldStar0417 as further GitHub accounts this one starred, characterizing them as confirmed DPRK. They are not recorded here: the post asserts the association, not that these are the same operator. A second post by the same researcher, headed "Classics", lists devsharp-tech, winner950617 and Stellar-1117 together. The first and third are described as confirmed DPRK GitHub accounts in the post above, and a GitHub account named winner950617 exists, so the third handle is recorded as a GitHub account on that basis rather than on the Classics post alone. The address winner950617@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/browsercookies/status/1947844753640632774 — Cookie Connoisseur (@browsercookies)
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.