https://github.com/shinevue
https://github.com/shinevue is a GitHub account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Heiner García.
The report is dated 2025-02-26.
github profile IT Worker Fraud RESEARCHER POST removed
removed
Source
-
Heiner García's article names a network of GitHub accounts it calls the SuperStar Campaign, after the words Super, Star and Dev that recur in the handles and a SuperStar user name on one member's machine, and places it with the Contagious Interview and Wagemole activity Unit 42 reports. The network centres on Finalgoal231, a GitHub organisation of eighteen members, most of which the article judges to be fake profiles, whose discussions show members starring one another's work, coordinating through Discord and rewriting commit histories to change addresses. It shows popstar7 renaming oddcommitking to Luis96920 in a pull request, and xaramore, a follower hub from the researcher's earlier work, now deleted. The first thirty-two accounts are the article's own closing list of suspicious accounts, less the two held back below, and the article describes that list as a sample of a larger confidential set; the last four, xaramore, Finalgoal231, oddcommitking and e-nitram, are named in its body. When read on 24 September 2026, deepsea514, GoodLuck0129 and xaramore no longer resolved, and kingp08 and Topstar88 resolved to accounts created in April 2026 and July 2025, after the article, so those two handles now belong to different holders than the ones it named.
www.linkedin.com/pulse/reviewing-activity-github-accounts-linked-dprk-heiner-garc%C3%ADa-p%C3%A9rez-xpkae/ — Heiner García
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.