Chollima Hunter

← Remote Workers

https://github.com/top-dev-999

https://github.com/top-dev-999 is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Narcass3 (@Narcass3). The report is dated 2025-07-05.

The reporting files it under the persona Idriz Shenji, alongside 4 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-07-05 · last seen 2025-07-05

Source

  • The post relates this identity to Aiden Mori and Evan Jones. The address is transcribed exactly as published, with outloook spelled with three letter o's; correcting it would invent an address the post does not state. The address topdeveloper1999@outlook.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
    x.com/Narcass3/status/1941538534386696464 — Narcass3 (@Narcass3) · under “Idriz Shenji / IdealCreator99” · published 2025-07-05 · pulled 2026-08-30

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created2021-03-11
Repositories29 original, 1 forked
History older than the account0 repositories
Commits copied into others' repositories0
Commit identities1 address, 4 names; up to 2 names on one address; up to 2 addresses under one name

Commit addresses this index holds

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-11. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Same persona record: Idriz Shenji

Other identifiers the reporting files under the same persona; 3 of 4 are shown.

All 4 on the Idriz Shenji page

Cited by the same report: x.com/Narcass3/status/1941538534386696464

Narcass3 (@Narcass3) lists 4 other indicators in this source. 1 are shown, chosen across types.

All 5 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.