https://www.linkedin.com/in/adam-lee-942953236/
https://www.linkedin.com/in/adam-lee-942953236/ is a LinkedIn account
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from meow mfer (@meow_mfer).
The report is dated 2025-06-08.
The reporting files it under the persona Adam Lee, alongside 7 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
linkedin profile IT Worker Fraud RESEARCHER POST removed
removed
Source
-
A reply to browsercookies giving the identity as a single block of addresses, a telephone number and four links. Two separate LinkedIn accounts are listed under the one name. The post text is complete rather than truncated, so the indicator list here is the whole of what it states. The address tyson.star.912.913@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The persona tysonstar912913, captured separately in this file from a later thread, is the same holder. Its address tyson.star.912913@gmail.com and the tyson.star.912.913@gmail.com recorded here differ only in the placement of a full stop, which Gmail ignores, so the normalizer already collapses both to one value and both personas already appear on that indicator. The commit walk of 2026-09-19 puts the resemblance beyond a shared mailbox: the repositories of both accounts carry commits from the same two author lines, tysonstar912913 <tyson.star.912913@gmail.com> 41 times here and 88 there, and adam719912 <tyson.star.912.913@gmail.com> 13 times here and 7 there. The profile README of adam912913 also still carries the template comment naming tysonstar912913/tysonstar912913, which records the account it was copied from. The two entries are kept apart because each is the record of a different researcher post, not because the site reads them as two people.
x.com/meow_mfer/status/1931534566155751856 — meow mfer (@meow_mfer)
Find this indicator in the index, or see every LinkedIn account this site holds under LinkedIn accounts in the browse listing.