headhunter705

edwinfz705@gmail.com

email address IT Worker Fraud CURATED

First seen 2026-09-20 · last seen 2026-09-20

Source

• Read on 20 September 2026 by walking the commit history of every repository on the GitHub account github.com/headhunter705, already held under this persona, and tallying the author line on every commit. A commit's author line is what the holder configured their git client with rather than anything the profile page chooses to display, so it recovers addresses the account never states. The address recorded here was not already in this index: edwin.fz.705@gmail.com authored 16 commits across the repository headhunter705/log-server, commits as "headhunter705". Each is admitted because it commits under a name the account itself uses, which is the test that separates the holder's own address from the original author of a repository copied in. Addresses belonging to unrelated developers whose work appears in these repositories are deliberately not recorded, and an address is evidence that whoever held it wrote those commits rather than proof of who holds the account.

  github.com/headhunter705 — Chollima Hunter · under “headhunter705” · pulled 2026-09-20

josemalheiro105@gmail.com

email address Contagious InterviewIT Worker Fraud CURATED

First seen 2026-05-17 · last seen 2026-09-24

Sources

• Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs the keylogger side of it. The two npm packages were, at the time of writing, still published and installable, and carry compiled Windows and Linux keyloggers that capture keystrokes system-wide; the article notes both packages ship the identical Linux binary, which is what places them on one build pipeline. The first hash is the Windows binary and the second the Linux one. Captured keystrokes and clipboard contents go to the hook-server2 address, clipboard changes and a victim beacon carrying operating system, hostname and username to the first address, and stolen browser-extension wallet data to the second. A separate post published the day before the article names the npm account that publishes both packages as topnotcher847, with the address recorded here, and reports the Windows binary inside them at 34 of 74 detections on VirusTotal, one vendor naming it as Lazarus tooling. That account and this GitHub operator are two identities in one operation rather than the same handle, which is worth stating because the two names sit beside each other in the reporting.

  x.com/meow_mfer/status/2055981353674654105 — meow mfer (@meow_mfer) · under “headhunter705” · published 2026-05-17 · pulled 2026-08-30

• Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 2 commits signed josemalheiro105@gmail.com, an address meow_mfer publishes for this persona, to the login top-notch-spec, which no longer resolves.

  github.com/top-notch-spec — Chollima Hunter · under “headhunter705” · pulled 2026-09-24

6e09249262d9a605180dfbd0939379bbf9f37db076980d6ffda98d650f70a16d

file hash Contagious Interview RESEARCHER POST

First seen 2026-05-18 · last seen 2026-05-18

Source

• Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs the keylogger side of it. The two npm packages were, at the time of writing, still published and installable, and carry compiled Windows and Linux keyloggers that capture keystrokes system-wide; the article notes both packages ship the identical Linux binary, which is what places them on one build pipeline. The first hash is the Windows binary and the second the Linux one. Captured keystrokes and clipboard contents go to the hook-server2 address, clipboard changes and a victim beacon carrying operating system, hostname and username to the first address, and stolen browser-extension wallet data to the second. A separate post published the day before the article names the npm account that publishes both packages as topnotcher847, with the address recorded here, and reports the Windows binary inside them at 34 of 74 detections on VirusTotal, one vendor naming it as Lazarus tooling. That account and this GitHub operator are two identities in one operation rather than the same handle, which is worth stating because the two names sit beside each other in the reporting.

  x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer) · under “headhunter705” · published 2026-05-18 · pulled 2026-08-30

e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1

file hash Contagious Interview RESEARCHER POST

First seen 2026-05-18 · last seen 2026-05-18

Source

• Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs the keylogger side of it. The two npm packages were, at the time of writing, still published and installable, and carry compiled Windows and Linux keyloggers that capture keystrokes system-wide; the article notes both packages ship the identical Linux binary, which is what places them on one build pipeline. The first hash is the Windows binary and the second the Linux one. Captured keystrokes and clipboard contents go to the hook-server2 address, clipboard changes and a victim beacon carrying operating system, hostname and username to the first address, and stolen browser-extension wallet data to the second. A separate post published the day before the article names the npm account that publishes both packages as topnotcher847, with the address recorded here, and reports the Windows binary inside them at 34 of 74 detections on VirusTotal, one vendor naming it as Lazarus tooling. That account and this GitHub operator are two identities in one operation rather than the same handle, which is worth stating because the two names sit beside each other in the reporting.

  x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer) · under “headhunter705” · published 2026-05-18 · pulled 2026-08-30

https://github.com/headhunter705

github profile Contagious Interview RESEARCHER POST live checked 2026-09-30

First seen 2026-05-18 · last seen 2026-05-18

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Source

• Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs the keylogger side of it. The two npm packages were, at the time of writing, still published and installable, and carry compiled Windows and Linux keyloggers that capture keystrokes system-wide; the article notes both packages ship the identical Linux binary, which is what places them on one build pipeline. The first hash is the Windows binary and the second the Linux one. Captured keystrokes and clipboard contents go to the hook-server2 address, clipboard changes and a victim beacon carrying operating system, hostname and username to the first address, and stolen browser-extension wallet data to the second. A separate post published the day before the article names the npm account that publishes both packages as topnotcher847, with the address recorded here, and reports the Windows binary inside them at 34 of 74 detections on VirusTotal, one vendor naming it as Lazarus tooling. That account and this GitHub operator are two identities in one operation rather than the same handle, which is worth stating because the two names sit beside each other in the reporting.

  x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer) · under “headhunter705” · published 2026-05-18 · pulled 2026-08-30

https://github.com/top-notch-spec

github profile IT Worker Fraud CURATED removed checked 2026-09-30

First seen 2026-09-24 · last seen 2026-09-24

Source

• Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 2 commits signed josemalheiro105@gmail.com, an address meow_mfer publishes for this persona, to the login top-notch-spec, which no longer resolves.

  github.com/top-notch-spec — Chollima Hunter · under “headhunter705” · pulled 2026-09-24

hook-server2.vercel.app

hosted site Contagious Interview RESEARCHER POST

First seen 2026-05-18 · last seen 2026-05-18

Source

• Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs the keylogger side of it. The two npm packages were, at the time of writing, still published and installable, and carry compiled Windows and Linux keyloggers that capture keystrokes system-wide; the article notes both packages ship the identical Linux binary, which is what places them on one build pipeline. The first hash is the Windows binary and the second the Linux one. Captured keystrokes and clipboard contents go to the hook-server2 address, clipboard changes and a victim beacon carrying operating system, hostname and username to the first address, and stolen browser-extension wallet data to the second. A separate post published the day before the article names the npm account that publishes both packages as topnotcher847, with the address recorded here, and reports the Windows binary inside them at 34 of 74 detections on VirusTotal, one vendor naming it as Lazarus tooling. That account and this GitHub operator are two identities in one operation rather than the same handle, which is worth stating because the two names sit beside each other in the reporting.

  x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer) · under “headhunter705” · published 2026-05-18 · pulled 2026-08-30

74.0.48.37

ip address Contagious Interview RESEARCHER POST

First seen 2026-05-18 · last seen 2026-05-18

Network

Looked up 2026-09-21 at ip-api.com. A subscriber line, as a person working from home ordinarily has.

Source

• Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs the keylogger side of it. The two npm packages were, at the time of writing, still published and installable, and carry compiled Windows and Linux keyloggers that capture keystrokes system-wide; the article notes both packages ship the identical Linux binary, which is what places them on one build pipeline. The first hash is the Windows binary and the second the Linux one. Captured keystrokes and clipboard contents go to the hook-server2 address, clipboard changes and a victim beacon carrying operating system, hostname and username to the first address, and stolen browser-extension wallet data to the second. A separate post published the day before the article names the npm account that publishes both packages as topnotcher847, with the address recorded here, and reports the Windows binary inside them at 34 of 74 detections on VirusTotal, one vendor naming it as Lazarus tooling. That account and this GitHub operator are two identities in one operation rather than the same handle, which is worth stating because the two names sit beside each other in the reporting.

  x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer) · under “headhunter705” · published 2026-05-18 · pulled 2026-08-30

89.213.118.38

ip address Contagious Interview RESEARCHER POST

First seen 2026-05-18 · last seen 2026-05-18

Network

Looked up 2026-09-21 at ip-api.com. This range is classed as a proxy or VPN; it does not show who used it.

Source

• Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs the keylogger side of it. The two npm packages were, at the time of writing, still published and installable, and carry compiled Windows and Linux keyloggers that capture keystrokes system-wide; the article notes both packages ship the identical Linux binary, which is what places them on one build pipeline. The first hash is the Windows binary and the second the Linux one. Captured keystrokes and clipboard contents go to the hook-server2 address, clipboard changes and a victim beacon carrying operating system, hostname and username to the first address, and stolen browser-extension wallet data to the second. A separate post published the day before the article names the npm account that publishes both packages as topnotcher847, with the address recorded here, and reports the Windows binary inside them at 34 of 74 detections on VirusTotal, one vendor naming it as Lazarus tooling. That account and this GitHub operator are two identities in one operation rather than the same handle, which is worth stating because the two names sit beside each other in the reporting.

  x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer) · under “headhunter705” · published 2026-05-18 · pulled 2026-08-30

logs-bin@3.11.14

npm package Contagious Interview RESEARCHER POST Live malware checked 2026-10-01

First seen 2026-05-18 · last seen 2026-05-18

Source

• Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs the keylogger side of it. The two npm packages were, at the time of writing, still published and installable, and carry compiled Windows and Linux keyloggers that capture keystrokes system-wide; the article notes both packages ship the identical Linux binary, which is what places them on one build pipeline. The first hash is the Windows binary and the second the Linux one. Captured keystrokes and clipboard contents go to the hook-server2 address, clipboard changes and a victim beacon carrying operating system, hostname and username to the first address, and stolen browser-extension wallet data to the second. A separate post published the day before the article names the npm account that publishes both packages as topnotcher847, with the address recorded here, and reports the Windows binary inside them at 34 of 74 detections on VirusTotal, one vendor naming it as Lazarus tooling. That account and this GitHub operator are two identities in one operation rather than the same handle, which is worth stating because the two names sit beside each other in the reporting.

  x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer) · under “headhunter705” · published 2026-05-18 · pulled 2026-08-30

logs-dump@1.7.5

npm package Contagious Interview RESEARCHER POST Live malware checked 2026-10-01

First seen 2026-05-18 · last seen 2026-05-18

Source

• Drawn from "Deep Dive into Active Github Network Running Contagious Interview", an article the researcher published on X in May 2026 covering an investigation running since mid-2025. The article names the same operation under the labels several vendors give it, Contagious Interview and PolinRider and UNC5342 among them, and describes an infection chain that begins with a repository sent during a fake interview and executes when the developer opens the folder in VS Code or Cursor. This operator runs the keylogger side of it. The two npm packages were, at the time of writing, still published and installable, and carry compiled Windows and Linux keyloggers that capture keystrokes system-wide; the article notes both packages ship the identical Linux binary, which is what places them on one build pipeline. The first hash is the Windows binary and the second the Linux one. Captured keystrokes and clipboard contents go to the hook-server2 address, clipboard changes and a victim beacon carrying operating system, hostname and username to the first address, and stolen browser-extension wallet data to the second. A separate post published the day before the article names the npm account that publishes both packages as topnotcher847, with the address recorded here, and reports the Windows binary inside them at 34 of 74 detections on VirusTotal, one vendor naming it as Lazarus tooling. That account and this GitHub operator are two identities in one operation rather than the same handle, which is worth stating because the two names sit beside each other in the reporting.

  x.com/meow_mfer/status/2056238427449004537 — meow mfer (@meow_mfer) · under “headhunter705” · published 2026-05-18 · pulled 2026-08-30