loki-engr

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, loki-engr. The attribution is theirs, not this site's.

IT Worker Fraud First reported 2026-04-17

Identifiers attributed to this persona

2 indicators the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
loki98957@gmail.com email address —
https://github.com/loki-engr github profile live checked 2026-09-30

loki98957@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post eleven presents this account as a probable member rather than a confirmed one: sixty repositories, in the primary account's following list, created May 2022, following nobody. The researcher says in terms that the confirmation is weaker than for the core group, and the record carries that caveat.
    x.com/meow_mfer/status/2045111016187638077 — meow mfer (@meow_mfer) · under “loki-engr” · published 2026-04-17 · pulled 2026-08-30

https://github.com/loki-engr

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-30

First seen 2026-04-17 · last seen 2026-04-17

Source

  • A fourteen-post thread on the accounts that worked on Tokamak Network's bridge front end, marketplace and subgraph between November 2023 and February 2025, read as a single cell from the primary account's following list, commit-email forensics, renamed and deleted handles, and account-creation dates clustered within days of each other. Every value here is stated in the thread; post thirteen is the researcher's own address map for the cell. Post eleven presents this account as a probable member rather than a confirmed one: sixty repositories, in the primary account's following list, created May 2022, following nobody. The researcher says in terms that the confirmation is weaker than for the core group, and the record carries that caveat.
    x.com/meow_mfer/status/2045111016187638077 — meow mfer (@meow_mfer) · under “loki-engr” · published 2026-04-17 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. loki-engr as the name of the operator is the cited researcher’s assertion, repeated here as their claim.