Benjamin

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Benjamin. The attribution is theirs, not this site's.

IT Worker Fraud First reported 2025-04-18

Identifiers attributed to this persona

1 indicator the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
Benjamin alias —

Benjamin

alias IT Worker Fraud RESEARCHER POST

Also listed under Peter Piao — this value’s page names all of them.

First seen 2025-04-18 · last seen 2025-04-23

Sources

  • The post states that this operator recruits others to carry out work for him and so scale the operation. The alias Benjmain Stewart is transcribed as the post spells it. Two follow-up posts in the same thread quote his recruiting message, sent to people listed on virtualstaff.ph as a Senior Software Developer from Singapore seeking a virtual assistant, and the arrangement offered: payments from customers land in the recruit's own account and card, and the recruit forwards 90 percent of the income to him. Neither post carries a further typable indicator.
    x.com/browsercookies/status/1915147733058412753 — Cookie Connoisseur (@browsercookies) · under “Peter Piao / Benjmain Stewart / Benjamin / Richard Moore / Aloukik / Deng / Vadim Titko / Parithong / Grigory Kotov” · published 2025-04-23 · pulled 2026-08-30
  • The second identity in the same post, given only as "a Benjamin", which the researcher says was also hired at an artificial intelligence company through the same Florida staffing agent. A given name on its own settles nothing and is recorded as exactly that.
    x.com/aptwhatnow/status/1913291827278414205 — aptwhatnow (@aptwhatnow) · under “Benjamin” · published 2025-04-18 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Benjamin as the name of the operator is the cited researcher’s assertion, repeated here as their claim.