Maria Nowak

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Maria Nowak. The attribution is theirs, not this site's.

IT Worker Fraud First reported 2026-09-23

Identifiers attributed to this persona

2 indicators the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
Maria Nowak alias —
maria359430@outlook.com email address —

Maria Nowak

alias IT Worker Fraud RESEARCHER POST

First seen 2026-09-23 · last seen 2026-09-23

Source

  • Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Poland; the address above is that mailbox. The register marks a LinkedIn profile as created for it; the profile's address is not published. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.
    haydenmckenzie.com/aliases/maria+nowak — Hayden McKenzie · under “Maria Nowak” · pulled 2026-09-23

maria359430@outlook.com

email address IT Worker Fraud RESEARCHER POST

First seen 2026-09-23 · last seen 2026-09-23

Source

  • Hayden McKenzie publishes this as one of 53 generated female personas in a DPRK IT worker cell's account register, each built around an Outlook mailbox and a LinkedIn profile for an identity based in Poland; the address above is that mailbox. The register marks a LinkedIn profile as created for it; the profile's address is not published. The report The Women Behind North Korea's IT Worker Operations, published the same day, attributes the register to a first-time operative the cell calls Jasmine Bell, who built it in her first weeks after being told to favour European identities because U.S. profiles were too troublesome to create; its own table counts 57 Outlook accounts across the eight country tabs, four more than the site publishes records for. The name is a generated identity, not the operator's, and a real woman who shares it is not the worker.
    haydenmckenzie.com/aliases/maria+nowak — Hayden McKenzie · under “Maria Nowak” · pulled 2026-09-23

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Maria Nowak as the name of the operator is the cited researcher’s assertion, repeated here as their claim.