Haruto Miura
Also reported as: TopDev707
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Haruto Miura. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Identifiers attributed to this persona
8 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Haruto Miura |
alias | |
haruto918miura@gmail.com |
email address | |
topdev707@gmail.com |
email address | |
https://github.com/angeldev918 |
github profile | live |
https://github.com/h918m |
github profile | live |
https://gitlab.com/haruto918miura |
gitlab account | live |
+16094590680 |
phone number | |
https://x.com/haruto918miura |
x account |
Haruto Miura
alias IT Worker Fraud CURATED
Sources
-
Every value here is in the post's own text, the two addresses defanged in the way this researcher writes them. The post ties the identity to a second one it calls TopDev707 and says the link runs to roughly a hundred further identities, which is the researcher's assessment of scale and not something this site can check. Several of these values were already in the index from published vendor reporting; what this entry adds is the researcher's grouping of them under one name.
x.com/browsercookies/status/1932932373609586853 — Cookie Connoisseur (@browsercookies) -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- haruto918miura -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Haruto Miura. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/haruto918miura — Chollima Hunter
haruto918miura@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
Every value here is in the post's own text, the two addresses defanged in the way this researcher writes them. The post ties the identity to a second one it calls TopDev707 and says the link runs to roughly a hundred further identities, which is the researcher's assessment of scale and not something this site can check. Several of these values were already in the index from published vendor reporting; what this entry adds is the researcher's grouping of them under one name.
x.com/browsercookies/status/1932932373609586853 — Cookie Connoisseur (@browsercookies) -
…Haruto Miura - linked to TopDev707 - x.com/haruto918miura - github.com/angeldev918 - github.com/h918m - topdev707@gmail.com - haruto918miura@gmail.com - +16094590680 - https://x.com/browsercookies/status/1932932373609586853 -  -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
topdev707@gmail.com
email address IT Worker Fraud MATCHED IN SOURCE
Sources
-
Every value here is in the post's own text, the two addresses defanged in the way this researcher writes them. The post ties the identity to a second one it calls TopDev707 and says the link runs to roughly a hundred further identities, which is the researcher's assessment of scale and not something this site can check. Several of these values were already in the index from published vendor reporting; what this entry adds is the researcher's grouping of them under one name.
x.com/browsercookies/status/1932932373609586853 — Cookie Connoisseur (@browsercookies) -
…Haruto Miura - linked to TopDev707 - x.com/haruto918miura - github.com/angeldev918 - github.com/h918m - topdev707@gmail.com - haruto918miura@gmail.com - +16094590680 - https://x.com/browsercookies/status/1932932373609586853 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/angeldev918
github profile IT Worker Fraud MATCHED IN SOURCE live
Listed as angeldev918
live
Sources
-
Every value here is in the post's own text, the two addresses defanged in the way this researcher writes them. The post ties the identity to a second one it calls TopDev707 and says the link runs to roughly a hundred further identities, which is the researcher's assessment of scale and not something this site can check. Several of these values were already in the index from published vendor reporting; what this entry adds is the researcher's grouping of them under one name.
x.com/browsercookies/status/1932932373609586853 — Cookie Connoisseur (@browsercookies) -
… -  #### Haruto Miura - linked to TopDev707 - x.com/haruto918miura - github.com/angeldev918 - github.com/h918m - topdev707@gmail.com - haruto918miura@gmail.com - +16094590680 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://github.com/h918m
github profile IT Worker Fraud MATCHED IN SOURCE live
Listed as h918m
live
Sources
-
Every value here is in the post's own text, the two addresses defanged in the way this researcher writes them. The post ties the identity to a second one it calls TopDev707 and says the link runs to roughly a hundred further identities, which is the researcher's assessment of scale and not something this site can check. Several of these values were already in the index from published vendor reporting; what this entry adds is the researcher's grouping of them under one name.
x.com/browsercookies/status/1932932373609586853 — Cookie Connoisseur (@browsercookies) -
… #### Haruto Miura - linked to TopDev707 - x.com/haruto918miura - github.com/angeldev918 - github.com/h918m - topdev707@gmail.com - haruto918miura@gmail.com - +16094590680 - https://x.com/browsercookies/status/1932932373609586853 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://gitlab.com/haruto918miura
gitlab account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- haruto918miura -- and asking GitLab whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a display name of Haruto Miura. The display name is kept here rather than carried as an alias, because it restates the handle, describes the work, or is too bare to be a name. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
gitlab.com/haruto918miura — Chollima Hunter
+16094590680
phone number IT Worker Fraud RESEARCHER POST
Line type
| Line type | VoIP |
|---|---|
| Carrier | SKYPE COMMUNICATIONS |
| Rate centre | DENNISVILLE, NJ |
Source
-
Every value here is in the post's own text, the two addresses defanged in the way this researcher writes them. The post ties the identity to a second one it calls TopDev707 and says the link runs to roughly a hundred further identities, which is the researcher's assessment of scale and not something this site can check. Several of these values were already in the index from published vendor reporting; what this entry adds is the researcher's grouping of them under one name.
x.com/browsercookies/status/1932932373609586853 — Cookie Connoisseur (@browsercookies)
https://x.com/haruto918miura
x account IT Worker Fraud RESEARCHER POST
Source
-
Every value here is in the post's own text, the two addresses defanged in the way this researcher writes them. The post ties the identity to a second one it calls TopDev707 and says the link runs to roughly a hundred further identities, which is the researcher's assessment of scale and not something this site can check. Several of these values were already in the index from published vendor reporting; what this entry adds is the researcher's grouping of them under one name.
x.com/browsercookies/status/1932932373609586853 — Cookie Connoisseur (@browsercookies)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- x.com/browsercookies/status/1932932373609586853 — Cookie Connoisseur (@browsercookies)
- gitlab.com/haruto918miura — Chollima Hunter