Chollima Hunter

← Remote Workers

https://github.com/warmice71

https://github.com/warmice71 is a GitHub account that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from meow mfer (@meow_mfer) and Coinmonks. The earliest of those reports is dated 2025-06-08 and the most recent 2025-07-22.

The reporting files it under the persona Au Wai Lun, alongside 2 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-09-02

Listed as warmice71

First seen 2025-06-08 · last seen 2025-07-22

Sources

  • The post describes this GitHub account as one of the few central accounts of the DPRK network on GitHub, used to promote and endorse the wider developer network rather than to carry a persona's own work, and warns that being followed by it is itself a signal. Four images are attached and the post text runs past the length the syndication endpoint returns, so only the account itself is transcribed; the follower and following lists it shows are not.
    x.com/meow_mfer/status/1931532334324699203 — meow mfer (@meow_mfer) · under “Au Wai Lun / Warmice71 / AuWaiLun” · published 2025-06-08 · pulled 2026-08-30
  • …On the profile of Warmice71, there’s a repository at https://github.com/warmice71/vinci-store-product-scraping . In this repository, we found videos that capture the screen, showing interactions with a client while performing work on UpWork Press…
    Summary of Findings on Suspicious GitHub Activity Linked to DPRK IT Workers — Coinmonks · under “Fake developers related to Lazarus:” · published 2025-07-22 · pulled 2026-09-12

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Same persona record: Au Wai Lun

Other identifiers the reporting files under the same persona; 1 of 2 are shown.

All 2 on the Au Wai Lun page

Cited by the same report: x.com/meow_mfer/status/1931532334324699203

meow mfer (@meow_mfer) lists 2 other indicators in this source. 1 are shown, chosen across types.

All 3 indicators from this source

Cited by the same report: Summary of Findings on Suspicious GitHub Activity Linked to DPRK IT Workers

Coinmonks lists 25 other indicators in this source. 10 are shown, chosen across types.

All 26 indicators from this source

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. See the sourcing methodology.