`https://github.com/topsdev126`

https://github.com/topsdev126 is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from NKInternet. The report is dated 2025-12-16.

github profile IT Worker Fraud MATCHED IN SOURCE live checked 2026-09-18

Listed as topsdev126

First seen 2025-12-16 · last seen 2025-12-16

live checked 2026-09-18

The image is the avatar this account displays, not evidence of who operates it.

Source

…That username is associated with a GitHub account, which still exists at the time of writing, though it shows little visible activity: https://github.com/topsdev126 On its own, the existence of the account does not indicate active use.…
Additional Notes on the Trevor Greer Infostealer Logs — NKInternet · under “Additional Notes on the Trevor Greer Infostealer Logs” · published 2025-12-16 · pulled 2026-09-12

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: Additional Notes on the Trevor Greer Infostealer Logs

NKInternet lists 2 other indicators in this source.