itloverman
Also reported as: Lover
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, itloverman. The attribution is theirs, not this site's.
The persona card the researcher published. The photograph is the one the identity presented and is not necessarily a picture of whoever operated it.
Identifiers attributed to this persona
3 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Lover |
alias | |
https://github.com/itloverman |
github profile | removed |
https://t.me/itloverman |
telegram account | live |
Lover
alias IT Worker Fraud RESEARCHER POST
Source
-
One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title "Fullstack Developer - Anything - MERN Stack - Freelancer" and links to Twitter, GitHub and Telegram. The post records that the GitHub account returned a 404 when it was written, so the account is recorded as one that existed rather than one that can be opened.
x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies)
https://github.com/itloverman
github profile IT Worker Fraud MATCHED IN SOURCE removed
Listed as itloverman
removed
Sources
-
One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title "Fullstack Developer - Anything - MERN Stack - Freelancer" and links to Twitter, GitHub and Telegram. The post records that the GitHub account returned a 404 when it was written, so the account is recorded as one that existed rather than one that can be opened.
x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies) -
… -  #### Lover Man - github.com/itloverman (404) - t.me/itloverman (ID: 6093085915) • ([Messages](./user-6093085915-@itloverman.txt)) -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
https://t.me/itloverman
telegram account IT Worker Fraud MATCHED IN SOURCE live
Listed as itloverman
live
Sources
-
One of four personas the post presents side by side, each as a single dark card giving a handle, a job title, a photograph and a row of platform links. The post's text carries the accounts; the card carries the title and the face. The researcher's own shorthand names this one differently in the text than the card does, and the card's spelling is what is used here, because that is the name the identity presents. The card gives the title "Fullstack Developer - Anything - MERN Stack - Freelancer" and links to Twitter, GitHub and Telegram. The post records that the GitHub account returned a 404 when it was written, so the account is recorded as one that existed rather than one that can be opened.
x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies) -
… -  #### Lover Man - github.com/itloverman (404) - t.me/itloverman (ID: 6093085915) • ([Messages](./user-6093085915-@itloverman.txt)) - https://x.com/browsercookies/status/1933591202550723029 -…
DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
Sources
- DPRK IT Workers — tayvano (lazarus-bluenoroff-research)
- x.com/browsercookies/status/1933591202550723029 — Cookie Connoisseur (@browsercookies)