chrisyon
Also reported as: ChrisYon
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, chrisyon. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
The persona card the researcher published. The photograph is the one the identity presented and is not necessarily a picture of whoever operated it.
Identifiers attributed to this persona
4 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
chrisyon |
alias | |
https://freelancer.com/u/dss2000 |
freelancer account | |
https://t.me/dss2000 |
telegram account | live |
https://t.me/wdev733 |
telegram account | live |
chrisyon
alias IT Worker Fraud CURATED
Sources
-
One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title "Senior Fullstack Engineer" and links to Twitter, GitHub, Telegram and LinkedIn. The post lists a third handle for this persona between the two Telegram accounts without saying which platform it belongs to; it is held back rather than typed, and the reasoning is in x-held-back.json.
x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies) -
Found on 18 September 2026 by putting dss2000, the Telegram login the index already holds for this persona, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. The account is live, states the display name dss2000, a location of India, and a registration date of 7 July 2018. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
www.freelancer.com/u/dss2000 — Chollima Hunter
https://freelancer.com/u/dss2000
freelancer account IT Worker Fraud CURATED
Source
-
Found on 18 September 2026 by putting dss2000, the Telegram login the index already holds for this persona, to Maigret's username search and then asking Freelancer's public user endpoint, which answers with the account record and, for a name that does not exist, with nothing. The account is live, states the display name dss2000, a location of India, and a registration date of 7 July 2018. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
www.freelancer.com/u/dss2000 — Chollima Hunter
https://t.me/dss2000
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as dss2000
live
Sources
-
One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title "Senior Fullstack Engineer" and links to Twitter, GitHub, Telegram and LinkedIn. The post lists a third handle for this persona between the two Telegram accounts without saying which platform it belongs to; it is held back rather than typed, and the reasoning is in x-held-back.json.
x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies) -
…devstar.sky20@gmail.com - github.com/cydn95 - 204.44.106.96 - t.me/micry 1012606692 - x.com/adchy2000 - t.me/wdev733 - t.me/dss2000 - 0x8260C20b4CE2014d760bE6dE7CDD98c4f12b68F8 - 0x574eC5a661c3eaA610438C4a249BCFC066c4a579 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://t.me/wdev733
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as wdev733
live
Sources
-
One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title "Senior Fullstack Engineer" and links to Twitter, GitHub, Telegram and LinkedIn. The post lists a third handle for this persona between the two Telegram accounts without saying which platform it belongs to; it is held back rather than typed, and the reasoning is in x-held-back.json.
x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies) -
…wdev733@gmail.com - devstar.sky20@gmail.com - github.com/cydn95 - 204.44.106.96 - t.me/micry 1012606692 - x.com/adchy2000 - t.me/wdev733 - t.me/dss2000 - 0x8260C20b4CE2014d760bE6dE7CDD98c4f12b68F8 - 0x574eC5a661c3eaA610438C4a249BCFC066c4a579 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies)
- www.freelancer.com/u/dss2000 — Chollima Hunter