Adam Lee
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Adam Lee. The attribution is theirs, not this site's.
Profile photograph published in the cited post, cut out against a white background in the way these portraits usually are. It is the image the identity presented as itself and is not necessarily a photograph of the person operating it.
LinkedIn accounts
https://www.linkedin.com/in/adam-lee-4162aa1b9/
removed
linkedin profile IT Worker Fraud RESEARCHER POST removed
Source
-
A reply to browsercookies giving the identity as a single block of addresses, a telephone number and four links. Two separate LinkedIn accounts are listed under the one name. The post text is complete rather than truncated, so the indicator list here is the whole of what it states. The address tyson.star.912.913@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The persona tysonstar912913, captured separately in this file from a later thread, is the same holder. Its address tyson.star.912913@gmail.com and the tyson.star.912.913@gmail.com recorded here differ only in the placement of a full stop, which Gmail ignores, so the normalizer already collapses both to one value and both personas already appear on that indicator. The commit walk of 2026-09-19 puts the resemblance beyond a shared mailbox: the repositories of both accounts carry commits from the same two author lines, tysonstar912913 <tyson.star.912913@gmail.com> 41 times here and 88 there, and adam719912 <tyson.star.912.913@gmail.com> 13 times here and 7 there. The profile README of adam912913 also still carries the template comment naming tysonstar912913/tysonstar912913, which records the account it was copied from. The two entries are kept apart because each is the record of a different researcher post, not because the site reads them as two people.
x.com/meow_mfer/status/1931534566155751856 — meow mfer (@meow_mfer)
https://www.linkedin.com/in/adam-lee-942953236/
removed
linkedin profile IT Worker Fraud RESEARCHER POST removed
Source
-
A reply to browsercookies giving the identity as a single block of addresses, a telephone number and four links. Two separate LinkedIn accounts are listed under the one name. The post text is complete rather than truncated, so the indicator list here is the whole of what it states. The address tyson.star.912.913@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The persona tysonstar912913, captured separately in this file from a later thread, is the same holder. Its address tyson.star.912913@gmail.com and the tyson.star.912.913@gmail.com recorded here differ only in the placement of a full stop, which Gmail ignores, so the normalizer already collapses both to one value and both personas already appear on that indicator. The commit walk of 2026-09-19 puts the resemblance beyond a shared mailbox: the repositories of both accounts carry commits from the same two author lines, tysonstar912913 <tyson.star.912913@gmail.com> 41 times here and 88 there, and adam719912 <tyson.star.912.913@gmail.com> 13 times here and 7 there. The profile README of adam912913 also still carries the template comment naming tysonstar912913/tysonstar912913, which records the account it was copied from. The two entries are kept apart because each is the record of a different researcher post, not because the site reads them as two people.
x.com/meow_mfer/status/1931534566155751856 — meow mfer (@meow_mfer)
Identifiers reported alongside
6 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Adam Lee |
alias | |
adamlee1126@gmail.com |
email address | |
tysonstar912913@gmail.com |
email address | |
yonexhuffman912913@gmail.com |
email address | |
https://github.com/adam912913 |
github profile | live |
+12108073329 |
phone number |
Adam Lee
alias IT Worker Fraud RESEARCHER POST
Source
-
A reply to browsercookies giving the identity as a single block of addresses, a telephone number and four links. Two separate LinkedIn accounts are listed under the one name. The post text is complete rather than truncated, so the indicator list here is the whole of what it states. The address tyson.star.912.913@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The persona tysonstar912913, captured separately in this file from a later thread, is the same holder. Its address tyson.star.912913@gmail.com and the tyson.star.912.913@gmail.com recorded here differ only in the placement of a full stop, which Gmail ignores, so the normalizer already collapses both to one value and both personas already appear on that indicator. The commit walk of 2026-09-19 puts the resemblance beyond a shared mailbox: the repositories of both accounts carry commits from the same two author lines, tysonstar912913 <tyson.star.912913@gmail.com> 41 times here and 88 there, and adam719912 <tyson.star.912.913@gmail.com> 13 times here and 7 there. The profile README of adam912913 also still carries the template comment naming tysonstar912913/tysonstar912913, which records the account it was copied from. The two entries are kept apart because each is the record of a different researcher post, not because the site reads them as two people.
x.com/meow_mfer/status/1931534566155751856 — meow mfer (@meow_mfer)
adamlee1126@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
A reply to browsercookies giving the identity as a single block of addresses, a telephone number and four links. Two separate LinkedIn accounts are listed under the one name. The post text is complete rather than truncated, so the indicator list here is the whole of what it states. The address tyson.star.912.913@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The persona tysonstar912913, captured separately in this file from a later thread, is the same holder. Its address tyson.star.912913@gmail.com and the tyson.star.912.913@gmail.com recorded here differ only in the placement of a full stop, which Gmail ignores, so the normalizer already collapses both to one value and both personas already appear on that indicator. The commit walk of 2026-09-19 puts the resemblance beyond a shared mailbox: the repositories of both accounts carry commits from the same two author lines, tysonstar912913 <tyson.star.912913@gmail.com> 41 times here and 88 there, and adam719912 <tyson.star.912.913@gmail.com> 13 times here and 7 there. The profile README of adam912913 also still carries the template comment naming tysonstar912913/tysonstar912913, which records the account it was copied from. The two entries are kept apart because each is the record of a different researcher post, not because the site reads them as two people.
x.com/meow_mfer/status/1931534566155751856 — meow mfer (@meow_mfer)
tysonstar912913@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Listed as tyson.star.912913@gmail.com
Also listed under tysonstar912913 — this value’s page names all of them.
Sources
-
A reply to browsercookies giving the identity as a single block of addresses, a telephone number and four links. Two separate LinkedIn accounts are listed under the one name. The post text is complete rather than truncated, so the indicator list here is the whole of what it states. The address tyson.star.912.913@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The persona tysonstar912913, captured separately in this file from a later thread, is the same holder. Its address tyson.star.912913@gmail.com and the tyson.star.912.913@gmail.com recorded here differ only in the placement of a full stop, which Gmail ignores, so the normalizer already collapses both to one value and both personas already appear on that indicator. The commit walk of 2026-09-19 puts the resemblance beyond a shared mailbox: the repositories of both accounts carry commits from the same two author lines, tysonstar912913 <tyson.star.912913@gmail.com> 41 times here and 88 there, and adam719912 <tyson.star.912.913@gmail.com> 13 times here and 7 there. The profile README of adam912913 also still carries the template comment naming tysonstar912913/tysonstar912913, which records the account it was copied from. The two entries are kept apart because each is the record of a different researcher post, not because the site reads them as two people.
x.com/meow_mfer/status/1931534566155751856 — meow mfer (@meow_mfer) -
A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Listed in the primary account's following list and in the address map. The persona Adam Lee, captured in this file from a June 2025 reply, is the same holder; the reasoning is recorded in that entry. Its address tyson.star.912.913@gmail.com and the tyson.star.912913@gmail.com recorded here are one Gmail mailbox, and the commit walk of 2026-09-19 found the same two author lines committing across both accounts' repositories.
x.com/meow_mfer/status/2045112535968596342 — meow mfer (@meow_mfer) -
…l.com trust.navraj@minofangle.org tryeverything0609@gmail.com tryeverything920609@gmail.com tt9846610@gmail.com tylerdennison0207@gmail.com tyson.star.912913@gmail.com ui.lee918@gmail.com unicorntoy753@proton.me univan0928@gmail.com unoyasushi0922@gmail.com uo0901576@gmail.com upmanager200@gmail.com upwork…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
yonexhuffman912913@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
A reply to browsercookies giving the identity as a single block of addresses, a telephone number and four links. Two separate LinkedIn accounts are listed under the one name. The post text is complete rather than truncated, so the indicator list here is the whole of what it states. The address tyson.star.912.913@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The persona tysonstar912913, captured separately in this file from a later thread, is the same holder. Its address tyson.star.912913@gmail.com and the tyson.star.912.913@gmail.com recorded here differ only in the placement of a full stop, which Gmail ignores, so the normalizer already collapses both to one value and both personas already appear on that indicator. The commit walk of 2026-09-19 puts the resemblance beyond a shared mailbox: the repositories of both accounts carry commits from the same two author lines, tysonstar912913 <tyson.star.912913@gmail.com> 41 times here and 88 there, and adam719912 <tyson.star.912.913@gmail.com> 13 times here and 7 there. The profile README of adam912913 also still carries the template comment naming tysonstar912913/tysonstar912913, which records the account it was copied from. The two entries are kept apart because each is the record of a different researcher post, not because the site reads them as two people.
x.com/meow_mfer/status/1931534566155751856 — meow mfer (@meow_mfer)
https://github.com/adam912913
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
A reply to browsercookies giving the identity as a single block of addresses, a telephone number and four links. Two separate LinkedIn accounts are listed under the one name. The post text is complete rather than truncated, so the indicator list here is the whole of what it states. The address tyson.star.912.913@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The persona tysonstar912913, captured separately in this file from a later thread, is the same holder. Its address tyson.star.912913@gmail.com and the tyson.star.912.913@gmail.com recorded here differ only in the placement of a full stop, which Gmail ignores, so the normalizer already collapses both to one value and both personas already appear on that indicator. The commit walk of 2026-09-19 puts the resemblance beyond a shared mailbox: the repositories of both accounts carry commits from the same two author lines, tysonstar912913 <tyson.star.912913@gmail.com> 41 times here and 88 there, and adam719912 <tyson.star.912.913@gmail.com> 13 times here and 7 there. The profile README of adam912913 also still carries the template comment naming tysonstar912913/tysonstar912913, which records the account it was copied from. The two entries are kept apart because each is the record of a different researcher post, not because the site reads them as two people.
x.com/meow_mfer/status/1931534566155751856 — meow mfer (@meow_mfer)
+12108073329
phone number IT Worker Fraud RESEARCHER POST
Line type
| Line type | VoIP |
|---|---|
| Carrier | SKYPE COMMUNICATIONS |
| Block carrier | CELLCO PARTNERSHIP DBA VERIZON WIRELESS - TX |
| Rate centre | SAN ANTONIO, TX |
Source
-
A reply to browsercookies giving the identity as a single block of addresses, a telephone number and four links. Two separate LinkedIn accounts are listed under the one name. The post text is complete rather than truncated, so the indicator list here is the whole of what it states. The address tyson.star.912.913@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author. The persona tysonstar912913, captured separately in this file from a later thread, is the same holder. Its address tyson.star.912913@gmail.com and the tyson.star.912.913@gmail.com recorded here differ only in the placement of a full stop, which Gmail ignores, so the normalizer already collapses both to one value and both personas already appear on that indicator. The commit walk of 2026-09-19 puts the resemblance beyond a shared mailbox: the repositories of both accounts carry commits from the same two author lines, tysonstar912913 <tyson.star.912913@gmail.com> 41 times here and 88 there, and adam719912 <tyson.star.912.913@gmail.com> 13 times here and 7 there. The profile README of adam912913 also still carries the template comment naming tysonstar912913/tysonstar912913, which records the account it was copied from. The two entries are kept apart because each is the record of a different researcher post, not because the site reads them as two people.
x.com/meow_mfer/status/1931534566155751856 — meow mfer (@meow_mfer)
Sources
- Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
- x.com/meow_mfer/status/1931534566155751856 — meow mfer (@meow_mfer)
- x.com/meow_mfer/status/2045112535968596342 — meow mfer (@meow_mfer)