`https://github.com/darq-envoy`

https://github.com/darq-envoy is a GitHub account that one published source reports in connection with Contagious Interview activity, which public reporting attributes to North Korea (DPRK). It is cited here from Kieran Miyamoto (kmsec). The report is dated 2026-02-21.

github profile Contagious Interview MATCHED IN SOURCE live checked 2026-09-18

Listed as darq-envoy

First seen 2026-02-21 · last seen 2026-02-21

live checked 2026-09-18

The image is the avatar this account displays, not evidence of who operates it.

Source

…find any third-party provenance of this code. Github presence The Google Drive payload is also observed in a GitHub repository — github.com/DARQ-Envoy/DCUK-Technical-Assessment — in file /frontend/public/images/splash.png .…
DPRK tests Google Drive as a malware stager — Kieran Miyamoto (kmsec) · under “Github presence” · published 2026-02-21 · pulled 2026-09-12

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created	2022-01-05
Repositories	59 original, 3 forked
History older than the account	0 repositories
Commits copied into others' repositories	0
Commit identities	1 address, 3 names; up to 3 names on one address; up to 2 addresses under one name

Commit addresses this index holds

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-11-05. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.

Related indicators

Cited by the same report: DPRK tests Google Drive as a malware stager

Kieran Miyamoto (kmsec) lists 2 other indicators in this source.