Axiom 88
Also reported as: CodechefCodemaster7thCode ChefChris LeeStephen WalshAlex TongEvgenia ShywaewajaneMichael RudreshwarAnna
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Axiom 88. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Profiles and evidence
Portrait used by the persona; the same photograph appears under the name Chris Lee on Cake, Ethereum Stack Exchange and Stack Overflow.
GitHub profile codemaster730, contact codechef730@gmail.com.
Identifiers attributed to this persona
11 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Alex Tong |
alias | |
Anna |
alias | |
Chris Lee |
alias | |
Codechef |
alias | |
Codemaster |
alias | |
Evgenia Shywaewajane |
alias | |
Michael Rudreshwar |
alias | |
Stephen Walsh |
alias | |
codechef730@gmail.com |
email address | |
https://github.com/codemaster730 |
github profile | removed |
https://gitlab.com/codechef730 |
gitlab account | live |
Alex Tong
alias IT Worker Fraud RESEARCHER POST
Source
-
The address is transcribed by hand from the attached screenshot of the GitHub profile page for codemaster730, which displays it under the profile's contact links.
x.com/browsercookies/status/1923538384968089871 — Cookie Connoisseur (@browsercookies)
Anna
alias IT Worker Fraud RESEARCHER POST
Source
-
The address is transcribed by hand from the attached screenshot of the GitHub profile page for codemaster730, which displays it under the profile's contact links.
x.com/browsercookies/status/1923538384968089871 — Cookie Connoisseur (@browsercookies)
Chris Lee
alias IT Worker Fraud RESEARCHER POST
Source
-
The address is transcribed by hand from the attached screenshot of the GitHub profile page for codemaster730, which displays it under the profile's contact links.
x.com/browsercookies/status/1923538384968089871 — Cookie Connoisseur (@browsercookies)
Codechef
alias IT Worker Fraud RESEARCHER POST
Source
-
The address is transcribed by hand from the attached screenshot of the GitHub profile page for codemaster730, which displays it under the profile's contact links.
x.com/browsercookies/status/1923538384968089871 — Cookie Connoisseur (@browsercookies)
Codemaster
alias IT Worker Fraud RESEARCHER POST
Source
-
The address is transcribed by hand from the attached screenshot of the GitHub profile page for codemaster730, which displays it under the profile's contact links.
x.com/browsercookies/status/1923538384968089871 — Cookie Connoisseur (@browsercookies)
Evgenia Shywaewajane
alias IT Worker Fraud RESEARCHER POST
Source
-
The address is transcribed by hand from the attached screenshot of the GitHub profile page for codemaster730, which displays it under the profile's contact links.
x.com/browsercookies/status/1923538384968089871 — Cookie Connoisseur (@browsercookies)
Michael Rudreshwar
alias IT Worker Fraud RESEARCHER POST
Source
-
The address is transcribed by hand from the attached screenshot of the GitHub profile page for codemaster730, which displays it under the profile's contact links.
x.com/browsercookies/status/1923538384968089871 — Cookie Connoisseur (@browsercookies)
Stephen Walsh
alias IT Worker Fraud RESEARCHER POST
Source
-
The address is transcribed by hand from the attached screenshot of the GitHub profile page for codemaster730, which displays it under the profile's contact links.
x.com/browsercookies/status/1923538384968089871 — Cookie Connoisseur (@browsercookies)
codechef730@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Password
watercup123
— from an infostealer log.
Sources
-
The address is transcribed by hand from the attached screenshot of the GitHub profile page for codemaster730, which displays it under the profile's contact links.
x.com/browsercookies/status/1923538384968089871 — Cookie Connoisseur (@browsercookies) -
…1QAZxsw balsinyar@gmail.com 11111111, Xiah audreybass140@gmail.com P@ssw0rd chainerspace@gmail.com qwe123QWE!@# codechef730@gmail.com watercup123 comsuper0030@gmail.com qweQWE123!@# danny.may.9012@gmail.com 123 darkhorse03111@gmail.com 123123…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
https://github.com/codemaster730
github profile IT Worker Fraud RESEARCHER POST removed
removed
Source
-
The address is transcribed by hand from the attached screenshot of the GitHub profile page for codemaster730, which displays it under the profile's contact links.
x.com/browsercookies/status/1923538384968089871 — Cookie Connoisseur (@browsercookies)
https://gitlab.com/codechef730
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- codechef730 -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states no display name but the handle itself. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/codechef730 — Chollima Hunter
Sources
- Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
- x.com/browsercookies/status/1923538384968089871 — Cookie Connoisseur (@browsercookies)
- gitlab.com/codechef730 — Chollima Hunter