Chollima Hunter

← All personas

Kei Haruto

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Kei Haruto. The attribution is theirs, not this site's.

IT Worker Fraud First reported 2026-09-23

Identifiers attributed to this persona

1 indicator the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
Kei Haruto alias —

Kei Haruto

alias IT Worker Fraud RESEARCHER POST

First seen 2026-09-23 · last seen 2026-09-23

Source

  • Hayden McKenzie's report names Kei Haruto as one of two operatives placed at an identity-and-access consultancy through MageHire, presented as Japanese and listed in Dalian, with a client address beginning kei.haruto@ (domain withheld). One of the two was internally said to have no Auth0 experience while billing Auth0 work.
    haydenmckenzie.com/research/dprk-it-worker-cell-part-one — Hayden McKenzie · under “Kei Haruto” · published 2026-09-23 · pulled 2026-09-24

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Kei Haruto as the name of the operator is the cited researcher’s assertion, repeated here as their claim.