https://github.com/0xcrypoops
https://github.com/0xcrypoops is a GitHub account
that one published source reports
in connection with IT Worker Fraud and Contagious Interview activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from tanuki42 (@tanuki42_).
The report is dated 2026-08-16.
The reporting files it under the persona Ming Cheng, alongside 13 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
github profile IT Worker FraudContagious Interview RESEARCHER POST removed
removed
Source
-
The researcher describes interviewing this identity as an applicant for a remote engineering role and assessing them as a North Korean IT worker. The account is presented under the name Ming Cheng. The thread notes a three-year gap in the resume covering 2018 to 2021, which the applicant explained as COVID-19 treatment beginning in 2019, months before the virus was known in China, and says the interview was cut short by a connection problem shortly after the applicant was asked whether he was North Korean. The third post of that thread publishes the whole application under the heading "all the fake details he applied with for anyone tracking", and is where the address, telephone number, GitHub, Telegram, IP address and website here come from. It was missed on the first pass: X renders a post that long behind a Show more control, and the syndication endpoint the reader uses returns it truncated and says so. It has to be read in a browser. That post also attributes the GitHub account to the Contagious Trader campaign, weaponised cryptocurrency trading bots, citing kmsec's write-up, which is already a source here; this entry carries that label alongside IT Worker Fraud because the researcher makes both claims. This is a second, independent researcher reaching the same conclusion about an identity the lazarus.group registry already records, so the account carries both citations. Two days after the thread that named this operator, the researcher reported that it had rotated to a new persona, 0xcrypoops, and gave the replacement X, GitHub and Telegram accounts. The three are recorded here rather than as a separate persona because the source states outright that they are the same operator continuing. Note that the Telegram handle for the replacement is not a copy of the other two: it begins with the letter o where the X and GitHub handles begin with a zero, and it is transcribed as the post links it.
x.com/tanuki42_/status/2088839296518164599 — tanuki42 (@tanuki42_)
Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.