Jackson Mori
Also reported as: jacksonmori755bluebird912Seow Xian Jin
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Jackson Mori. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Portrait published in the cited post. It shows the image the identity presented as itself, which these personas routinely take from an uninvolved person or generate.
LinkedIn accounts
https://www.linkedin.com/in/jacksonmori/
linkedin profile IT Worker Fraud RESEARCHER POST
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
Identifiers reported alongside
28 indicators the sources below record for this operator, each with its sources.
Jackson Mori
alias IT Worker Fraud CURATED
Sources
-
The post notes the persona's stated location is Canada in one place and San Gabriel, California in another.
x.com/browsercookies/status/1951455293273190878 — Cookie Connoisseur (@browsercookies) -
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García -
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- bluebird912 -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 6 July 2023 and a display name of Seow Xian Jin. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/bluebird912 — Chollima Hunter -
Found on 24 September 2026 by reading which account GitHub attributes commits signed willyu226@gmail.com to. GitHub credits a commit to the account that has the signing address registered, which only the mailbox's holder can arrange. willyu226@gmail.com is one of the two addresses github.com/loveFeynman signs its own commits with, under the name William Yu, and loveFeynman is filed under "GitHub accounts working in the same repositories as the Eric Liu persona". GitHub attributes the address's commits to github.com/jacksonmori, account id 133004101, created on 9 May 2023, display name Jackson Mori, whose profile describes it as a blockchain developer at Router Protocol: among them the commits in loveFeynman's own repositories self-repaying-protocol and style-transfer, from March and April 2022. The account carries the name of the persona browsercookies ties to github.com/jacksonmori755, whose portfolio duplicates loveFeynman's repositories. The holder of loveFeynman's William Yu mailbox therefore also holds an account in the Jackson Mori name, which joins the Eric Liu working circle to that persona.
github.com/jacksonmori — Chollima Hunter -
Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (jacksonmori) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
github.com/ChangeYourself0613/My-Website/blob/a13cd8ef00ea35452a0712adf2db7f9383508f54/src/components/Contact.jsx — Chollima Hunter
Seow Xian Jin
alias IT Worker Fraud CURATED
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- bluebird912 -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 6 July 2023 and a display name of Seow Xian Jin. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/bluebird912 — Chollima Hunter
https://crypto.jobs/talent/profile/blockchain-engineer-149
cryptojobs account IT Worker Fraud RESEARCHER POST
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
https://cryptojobslist.com/@jackson_mori
cryptojobslist account IT Worker Fraud RESEARCHER POST
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
https://dev.to/bluebird912
devto account IT Worker Fraud CURATED live
live
Source
-
Found on 18 September 2026 by taking the local part of an address this index already holds for this operator -- bluebird912 -- and asking dev.to whether an account exists under it. The address is on a consumer mail host, where the local part is a login the holder chose rather than one an employer assigned; handles taken from company addresses were excluded from this pass for that reason. The account states a registration date of 6 July 2023 and a display name of Seow Xian Jin. The login is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification.
dev.to/bluebird912 — Chollima Hunter
https://dev.to/jacksonmoridev0507
devto account IT Worker Fraud RESEARCHER POST live
live
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
bluebird912@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The post notes the persona's stated location is Canada in one place and San Gabriel, California in another.
x.com/browsercookies/status/1951455293273190878 — Cookie Connoisseur (@browsercookies)
jackson@routerprotocol.com
email address IT Worker Fraud RESEARCHER POST
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
jacksonmori755@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The post notes the persona's stated location is Canada in one place and San Gabriel, California in another.
x.com/browsercookies/status/1951455293273190878 — Cookie Connoisseur (@browsercookies)
jacksonmoridev@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The post notes the persona's stated location is Canada in one place and San Gabriel, California in another.
x.com/browsercookies/status/1951455293273190878 — Cookie Connoisseur (@browsercookies)
moridev@gmail.com
email address IT Worker Fraud CURATED
Source
-
Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (jacksonmori) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.
github.com/ChangeYourself0613/My-Website/blob/a13cd8ef00ea35452a0712adf2db7f9383508f54/src/components/Contact.jsx — Chollima Hunter
willyu226@gmail.com
email address IT Worker Fraud CURATED
Sources
-
Found on 24 September 2026 by reading which account GitHub attributes commits signed willyu226@gmail.com to. GitHub credits a commit to the account that has the signing address registered, which only the mailbox's holder can arrange. willyu226@gmail.com is one of the two addresses github.com/loveFeynman signs its own commits with, under the name William Yu, and loveFeynman is filed under "GitHub accounts working in the same repositories as the Eric Liu persona". GitHub attributes the address's commits to github.com/jacksonmori, account id 133004101, created on 9 May 2023, display name Jackson Mori, whose profile describes it as a blockchain developer at Router Protocol: among them the commits in loveFeynman's own repositories self-repaying-protocol and style-transfer, from March and April 2022. The account carries the name of the persona browsercookies ties to github.com/jacksonmori755, whose portfolio duplicates loveFeynman's repositories. The holder of loveFeynman's William Yu mailbox therefore also holds an account in the Jackson Mori name, which joins the Eric Liu working circle to that persona.
github.com/loveFeynman/self-repaying-protocol — Chollima Hunter -
Read on 24 September 2026. lazarus.group attributes three GitHub accounts to the Eric Liu persona, github.com/vigorousdeveloper, github.com/SuperVenus0725 and github.com/Jason07250000, with the commit addresses vigorousdevelopment524@gmail.com and venus07250000@gmail.com; tayvano lists the same accounts. Searching GitHub for commits signed with those two addresses finds them inside repositories owned by six accounts this index did not hold. The accounts are recorded here as people the persona worked beside, not as further accounts of the persona: each commits under its own address and name, and nothing read so far shows one hand behind them. Three of the six were created on one day. github.com/loveFeynman (account id 95080253) was created at 10:53 UTC on 26 November 2021, github.com/kdbvier (95093693) at 15:34, and github.com/nightskydev (95094109) at 15:42, eight minutes after kdbvier. github.com/sheriff-rango (95250818) followed on 29 November 2021. The work is contemporaneous, not copied. In kdbvier/steampunks, kdbvier signed 21 commits and vigorousdeveloper 11 between 7 and 20 June 2022, and in kdbvier/Juno-Farming vigorousdeveloper signed 12 between 15 and 23 June 2022, followed by Jason07250000 in July. kdbvier/binance-trading-bot holds only the persona's commits, from January and April 2022. In nightskydev/picasso_frontend, created 19 June 2022, nightfury1111111111 signed 35 commits with linjay0208@gmail.com (the nightfury1111111111 account has since been deleted), the address every commit of nightskydev's own is signed with, while vigorousdeveloper signed 12 and kdbvier 6 over the same weeks; nightskydev/picasso_contract holds only the persona's commits. loveFeynman created mirror_protocol_stake_withdraw on 19 January 2022 and the persona committed into it as Eric Liu two days later; in loveFeynman/maui-frontend the two alternate across 2 to 5 January 2022. loveFeynman signs its own commits wando0226@gmail.com and willyu226@gmail.com under the names loveFeynman, wando and William Yu, and four commits signed William Yu with wando0226@gmail.com sit in vigorousdeveloper/NFT-AUCTION, dated 9 to 12 February 2022. sheriff-rango signed at least 99 commits in kdbvier/nfthope between 14 July and 13 September 2022. In frozenflux2/Solana_FE, created 23 February 2024, SuperVenus0725 committed with both of the persona's addresses in March 2024 beside frozenflux2's own aurora518star.com@gmail.com. The follow graph agrees. SuperVenus0725 and loveFeynman follow each other, as do loveFeynman and sheriff-rango; vigorousdeveloper follows loveFeynman, kdbvier and nightskydev; kdbvier follows loveFeynman and SuperVenus0725. Code also moved from these accounts into the persona's portfolio and back. loveFeynman's human_marketplace, first committed 13 August 2022, reappears with its history in SuperVenus0725/humanmarket (created 24 October 2022), sheriff-rango/HumansMarketplace and Calebtan978/HumansMarketplace. sheriff-rango created 24 repositories on 14 November 2022, 14 of which carry Jason07250000 commits from June 2022, and Calebtan978 holds eight carrying the same address. Calebtan978 is filed on weaker ground than the other five. Its repositories are copies rather than shared work, created in May 2023 over commits from 2022. What adds to it is the account itself, id 132147781, created at 14:02 UTC on 29 April 2023, four minutes after github.com/niceDeve (132147539), which this index holds from Coinmonks' reporting on DPRK-linked GitHub activity. An innocent reading was considered and set aside. A client who hires a contractor also creates repositories that the contractor then commits into, and nextnet-works, a company organisation with 266 repositories into which both SuperVenus0725 and loveFeynman committed in 2023, is left out for that reason. The six accounts above do not fit that reading: three were created within five hours of one another, they hold one another's code as portfolio, and they follow one another. KentaMori115 is also left out, because its only link is a 2023 copy of Juno-Farming carrying the persona's 2022 commits, which is how a copied repository looks.
github.com/loveFeynman — Chollima Hunter
https://github.com/jacksonmori
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by reading which account GitHub attributes commits signed willyu226@gmail.com to. GitHub credits a commit to the account that has the signing address registered, which only the mailbox's holder can arrange. willyu226@gmail.com is one of the two addresses github.com/loveFeynman signs its own commits with, under the name William Yu, and loveFeynman is filed under "GitHub accounts working in the same repositories as the Eric Liu persona". GitHub attributes the address's commits to github.com/jacksonmori, account id 133004101, created on 9 May 2023, display name Jackson Mori, whose profile describes it as a blockchain developer at Router Protocol: among them the commits in loveFeynman's own repositories self-repaying-protocol and style-transfer, from March and April 2022. The account carries the name of the persona browsercookies ties to github.com/jacksonmori755, whose portfolio duplicates loveFeynman's repositories. The holder of loveFeynman's William Yu mailbox therefore also holds an account in the Jackson Mori name, which joins the Eric Liu working circle to that persona.
github.com/jacksonmori — Chollima Hunter
https://github.com/jacksonmori755
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
The post notes the persona's stated location is Canada in one place and San Gabriel, California in another.
x.com/browsercookies/status/1951455293273190878 — Cookie Connoisseur (@browsercookies)
https://github.com/jacksonmoridev0507
github profile IT Worker Fraud RESEARCHER POST removed
removed
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
https://github.com/tender-terminal
github profile IT Worker Fraud RESEARCHER POST live
live
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
https://himalayas.app/@jacksonmori
himalayas account IT Worker Fraud RESEARCHER POST live
live
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
jacksonmori.vercel.app
hosted site IT Worker Fraud RESEARCHER POST
Sources
-
The post notes the persona's stated location is Canada in one place and San Gabriel, California in another.
x.com/browsercookies/status/1951455293273190878 — Cookie Connoisseur (@browsercookies) -
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
my-portfolio-pi-snowy.vercel.app
hosted site IT Worker Fraud RESEARCHER POST
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
my-website-iota-liard.vercel.app
hosted site IT Worker Fraud RESEARCHER POST
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
+12034233572
phone number IT Worker Fraud RESEARCHER POST
Line type
| Line type | VoIP |
|---|---|
| Carrier | SKYPE P2P |
| Rate centre | WILTON, CT |
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
https://remoteok.com/@jackson_mori
remoteok account IT Worker Fraud RESEARCHER POST live
live
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
https://t.me/dreamy327
telegram account IT Worker Fraud RESEARCHER POST live
live
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
https://torre.ai/jacksonmori
torre account IT Worker Fraud RESEARCHER POST live
live
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
https://useme.com/en/roles/contractor/jackson-mori,334027
useme account IT Worker Fraud RESEARCHER POST
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
https://web3.career/@4461
web3career account IT Worker Fraud RESEARCHER POST
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
https://x.com/jacksonmori11
x account IT Worker Fraud RESEARCHER POST
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
https://x.com/rhehehje_dudjd
x account IT Worker Fraud RESEARCHER POST
Source
-
Heiner García's post of 2 August 2025 follows Jackson Mori, whom it assesses as very probably a DPRK IT worker, through GitHub work for Router Protocol from May 2024 to March 2025 under the address jackson@routerprotocol.com, and a set of profiles on job boards that recycle one bio and a few images and claim California, Canada or Japan in turn. The portfolio at my-portfolio-pi-snowy.vercel.app gives the phone number, the jacksonmoridev0507 GitHub account and the LinkedIn profile; the dev.to and F6S profiles give Tender-Terminal, which follows the DPRK-linked BitFancy. Router Protocol gave the author the Telegram handle, and the account blocked him when he asked about the DPRK. The two X accounts use the name and reference Router Protocol.
heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
Sources
- x.com/browsercookies/status/1951455293273190878 — Cookie Connoisseur (@browsercookies)
- heinerg.medium.com/who-is-jackson-mori-78e2b1be5cd8 — Heiner García
- dev.to/bluebird912 — Chollima Hunter
- github.com/jacksonmori — Chollima Hunter
- github.com/loveFeynman/self-repaying-protocol — Chollima Hunter
- github.com/ChangeYourself0613/My-Website/blob/a13cd8ef00ea35452a0712adf2db7f9383508f54/src/components/Contact.jsx — Chollima Hunter
- github.com/loveFeynman — Chollima Hunter