andrew-mooney-76a144332
A profile a reviewer opened and left under review. It matches screening signals of DPRK IT-worker personas; no connection to those operations is stated.
| Status | under review |
|---|---|
| Confidence | medium |
| Profile |
linkedin.com/in/andrew-mooney-76a144332/
|
| Account created | 2024-10 |
| Network |
14 connections
14 followers |
| Claims | 2 employers |
| Verifications | work email verified for itel in November 2024 |
| Line type | N/A — none published |
| Photograph |
FACE, UNSCORED
|
| Signals | Role titleAccount age vs claimReal namesakeSmall networkSparse historyClaims key access |
| Surfaced by | operator-submitted |
| Found by | LinkedIn addresses handed to the queue by the site's operator from their own browsing, with no query behind them |
| First seen | 2026-10-03 |
| Last checked | 2026-10-03 |
Indicators
- LINKEDIN PROFILE linkedin.com/in/andrew-mooney-76a144332/
Indexed in the Remote Workers search, each with its own page:
Review
Handed to the queue by the site's operator, who identified it as impersonating an established account under the same name, and opened under an authenticated session on 3 October 2026. The account presents as Andrew Mooney, Senior Software Security Engineer at Itel Inc, Orlando, Florida, with 14 connections, no posts, and two roles: itel, full-time, remote, from October 2024, "overseeing all security aspects of Software", and Underguard llc in November 2024. Its education entry is incoherent: "Dalhousie University Information Technology Services, MIT, Computer Science, March 1997 to April 1999, grade 4.0". The photograph is the one the established account uses, and that account belongs to a US technology executive with decades of public work; it is the person whose identity is borrowed and is deliberately not linked or named beyond the shared name. The About this member panel gives Joined LinkedIn October 2024 and a work email verified for itel in November 2024, which means whoever holds the account passed an employer's email check at a company whose role gives access to the security of its software. That is the privileged-access sign and the reason the row matters. No value here is shared with any persona the site holds and no cited report names the account, so DPRK affiliation is not stated.
Sources
- Chollima Hunter review, last checked 2026-10-03