`https://github.com/hyperbuildx`

https://github.com/hyperbuildx is a GitHub account that 2 published sources report in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from bbsz (@blackbigswan) and Kawaii Jong UwUn (HyperBuildX-Continued-Research). The earliest of those reports is dated 2025-10-01 and the most recent 2026-11-13.

github profile IT Worker Fraud MATCHED IN SOURCE removed checked 2026-09-30

Listed as hyperbuildx

First seen 2025-10-01 · last seen 2026-11-13

removed checked 2026-09-30

Sources

The report states HyperbuildX is fully operated by DPRK IT workers. Its address was first hyperbuildx@adamglab.dev and later admin@hyperbuildx.com; adamglab.dev is the portfolio domain the report says justshiftjk used.
www.ketman.org/dprk-it-workers-github-organizations.html — bbsz (@blackbigswan) · under “HyperbuildX, a GitHub organisation operated by DPRK IT workers (Ketman)” · published 2025-10-01 · pulled 2026-09-29
…{"id":"6feeca4f39a95741","type":"link","url":"https://github.com/HyperBuildX","x":580,"y":2380,"width":400,"height":400},…
HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub — Kawaii Jong UwUn (HyperBuildX-Continued-Research) · under “File metadata and controls” · pulled 2026-10-12

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Related indicators

Cited by the same report: www.ketman.org/dprk-it-workers-github-organizations.html

bbsz (@blackbigswan) lists 47 other indicators in this source. 7 are shown, chosen across types.

All 48 indicators from this source

Cited by the same report: HyperBuildX-Continued-Research/HyperBuildX Follow-up.canvas at main · Kawaii-Jong-UWUn/HyperBuildX-Continued-Research · GitHub

Kawaii Jong UwUn (HyperBuildX-Continued-Research) lists 44 other indicators in this source. 5 are shown, chosen across types.

All 45 indicators from this source