cryptostar7
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, cryptostar7. The attribution is theirs, not this site's.
Profiles and evidence
GitHub profile cryptostar7 the persona presented.
Identifiers attributed to this persona
2 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
karrem1281@outlook.sa |
email address | |
https://github.com/cryptostar7 |
github profile | live |
karrem1281@outlook.sa
email address IT Worker Fraud RESEARCHER POST
Source
-
The account name is transcribed by hand from the attached screenshot of the GitHub profile page, which carries the handle cryptostar7 and describes the holder as a freelancer and job seeker working in blockchain. The address karrem1281@outlook.sa is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/browsercookies/status/1915111997353439448 — Cookie Connoisseur (@browsercookies)
https://github.com/cryptostar7
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The account name is transcribed by hand from the attached screenshot of the GitHub profile page, which carries the handle cryptostar7 and describes the holder as a freelancer and job seeker working in blockchain. The address karrem1281@outlook.sa is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.
x.com/browsercookies/status/1915111997353439448 — Cookie Connoisseur (@browsercookies)
Sources
- x.com/browsercookies/status/1915111997353439448 — Cookie Connoisseur (@browsercookies)