`https://github.com/astrasbytesyncs`

https://github.com/astrasbytesyncs is a GitHub account that 2 published sources report in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter and Sophos. The earliest of those reports is dated 2026-03-23 and the most recent 2026-09-28.

github profile Contagious Interview CURATED live checked 2026-09-30

Listed as astrasbytesyncs

First seen 2026-03-23 · last seen 2026-09-28

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Sources

Found on 28 September 2026 by asking GitHub's commit search where three addresses from Hacking But Legal's committer-email list (lxin6793@gmail.com, randhawamanpreet37@gmail.com and webvlada2024@gmail.com) have committed. GitHub credits them to lxin6793-dot (filed earlier), Mann-004 and sparkdev0917, all three since deleted, and their commits sit in the same set of repositories: projects presented as MVPs and demos of real Web3 companies (0G Labs, A5 Labs, Ritual, Lukso, Improbable, Autonomys, Dapper Labs, Blockdaemon, Holitix, Astra Byte Sync and others), each under an organisation or account created in 2025 or 2026 holding that one repository. Those owners and repositories are carried. Copies of the same projects under long-established personal accounts in real names are left out: they read as candidates who received the lure, or researchers, not the people who wrote it, and three newer personal accounts that could be either are held. The source's list also holds the addresses of developers whose code the lures copied; those are held back.
www.hackingbutlegal.com/p/north-korea-is-hiring — Chollima Hunter · under “Impersonation-company lure repositories written by Hacking But Legal's lure-author addresses (Contagious Interview)” · published 2026-07-15 · pulled 2026-09-28
…and IP addresses may contain malicious content, so consider the risks before opening them in a browser. Indicator Type Context https://github.com/astrasbytesyncs/web3-social-platform URL GitHub repository operated by NICKEL ALLEY astrabytesyncs.com Domain name Fake company website operated by NICKEL ALLEY…
NICKEL ALLEY strategy: Fake it ‘til you make it — Sophos · under “Detections and threat indicators” · published 2026-03-23 · pulled 2026-09-12

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created	2025-09-29
Repositories	2 original, 10 forked
History older than the account	1 repository: `web3-social-platform` (first commit 2017-12-03)
Commits copied into others' repositories	0
Commit identities	0 addresses, 0 names

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-26. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Cited by the same report: www.hackingbutlegal.com/p/north-korea-is-hiring

Chollima Hunter lists 97 other indicators in this source. 7 are shown, chosen across types.

All 98 indicators from this source

Cited by the same report: NICKEL ALLEY strategy: Fake it ‘til you make it

Sophos lists 13 other indicators in this source. 5 are shown, chosen across types.

All 14 indicators from this source