cuda-toolkit
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, cuda-toolkit. The attribution is theirs, not this site's.
Identifiers attributed to this persona
1 indicator the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
https://github.com/cuda-toolkit |
github profile | removed |
https://github.com/cuda-toolkit
github profile Contagious Interview RESEARCHER POST removed
removed
Source
-
Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This account, deleted by the time the article was published, hosted malware payloads as GitHub Gists dressed up as CUDA toolkit and PyTorch simulation scripts, using the Gist service itself as the delivery channel. It is recorded because the handle is the only durable identifier the article gives for that delivery method, not because the account is expected to resolve.
x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer)
Sources
- x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer)