Masahi Saga
Also reported as: Minnel LeanRamon LopezRowell CameroRian McCallla
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Masahi Saga. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Resume header the cited post publishes, headed Masahi Saga, Full Stack & Blockchain Engineer, with a Mountain View address, masahisaga.dev@gmail.com and a portrait. It shows whoever appeared under the identity, not necessarily the operator.
Identifiers attributed to this persona
14 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Masahi Saga |
alias | |
Minnel Lean |
alias | |
Ramon Lopez |
alias | |
Rian McCallla |
alias | |
Rowell Camero |
alias | |
greenfashiondev@gmail.com |
email address | |
hdreamdev@gmail.com |
email address | |
magicfront68@gmail.com |
email address | |
masahisagadev@gmail.com |
email address | |
maudwisozk@gmail.com |
email address | |
ramonlopez0322@gmail.com |
email address | |
https://github.com/boywhocriedwolf |
github profile | removed |
https://github.com/magic-front |
github profile | removed |
https://github.com/yugin89 |
github profile | live |
Masahi Saga
alias IT Worker Fraud CURATED
Sources
-
The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.
x.com/browsercookies/status/1931028063015571653 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 25 commits signed magic.front.68@gmail.com, an address browsercookies publishes for this persona, to the login Magic-Front, which no longer resolves. GitHub attributes 1 commit signed greenfashiondev@gmail.com, an address browsercookies publishes for this persona, to github.com/Yugin89, account id 200094463, created on 20 February 2025, with 5 public repositories. GitHub attributes 100 commits signed hdreamdev@gmail.com, an address browsercookies publishes for this persona, to the login BoyWhoCriedWolf, which no longer resolves.
github.com/Magic-Front — Chollima Hunter
Minnel Lean
alias IT Worker Fraud RESEARCHER POST
Source
-
The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.
x.com/browsercookies/status/1931028063015571653 — Cookie Connoisseur (@browsercookies)
Ramon Lopez
alias IT Worker Fraud RESEARCHER POST
Source
-
The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.
x.com/browsercookies/status/1931028063015571653 — Cookie Connoisseur (@browsercookies)
Rian McCallla
alias IT Worker Fraud RESEARCHER POST
Source
-
The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.
x.com/browsercookies/status/1931028063015571653 — Cookie Connoisseur (@browsercookies)
Rowell Camero
alias IT Worker Fraud RESEARCHER POST
Source
-
The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.
x.com/browsercookies/status/1931028063015571653 — Cookie Connoisseur (@browsercookies)
greenfashiondev@gmail.com
email address IT Worker Fraud CURATED
Sources
-
The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.
x.com/browsercookies/status/1931028660938789239 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 25 commits signed magic.front.68@gmail.com, an address browsercookies publishes for this persona, to the login Magic-Front, which no longer resolves. GitHub attributes 1 commit signed greenfashiondev@gmail.com, an address browsercookies publishes for this persona, to github.com/Yugin89, account id 200094463, created on 20 February 2025, with 5 public repositories. GitHub attributes 100 commits signed hdreamdev@gmail.com, an address browsercookies publishes for this persona, to the login BoyWhoCriedWolf, which no longer resolves.
github.com/Yugin89 — Chollima Hunter
hdreamdev@gmail.com
email address IT Worker Fraud CURATED
Sources
-
The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.
x.com/browsercookies/status/1931028660938789239 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 25 commits signed magic.front.68@gmail.com, an address browsercookies publishes for this persona, to the login Magic-Front, which no longer resolves. GitHub attributes 1 commit signed greenfashiondev@gmail.com, an address browsercookies publishes for this persona, to github.com/Yugin89, account id 200094463, created on 20 February 2025, with 5 public repositories. GitHub attributes 100 commits signed hdreamdev@gmail.com, an address browsercookies publishes for this persona, to the login BoyWhoCriedWolf, which no longer resolves.
github.com/BoyWhoCriedWolf — Chollima Hunter -
…rydev0724@gmail.com harryluck505@gmail.com hatoyama1115+22@gmail.com hatoyama1115@gmail.com hawkpeter0324@gmail.com haxoni1552@viperace.com hdreamdev@gmail.com heidikalatasra20@gmail.com helemonar2023@gmail.com hellojohnsmith0521@gmail.com hendrik.flynn@minofangle.org henrybaldovino81@gmail.com her…
Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
magicfront68@gmail.com
email address IT Worker Fraud CURATED
Sources
-
The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.
x.com/browsercookies/status/1931028660938789239 — Cookie Connoisseur (@browsercookies) -
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 25 commits signed magic.front.68@gmail.com, an address browsercookies publishes for this persona, to the login Magic-Front, which no longer resolves. GitHub attributes 1 commit signed greenfashiondev@gmail.com, an address browsercookies publishes for this persona, to github.com/Yugin89, account id 200094463, created on 20 February 2025, with 5 public repositories. GitHub attributes 100 commits signed hdreamdev@gmail.com, an address browsercookies publishes for this persona, to the login BoyWhoCriedWolf, which no longer resolves.
github.com/Magic-Front — Chollima Hunter
masahisagadev@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.
x.com/browsercookies/status/1931029205711769690 — Cookie Connoisseur (@browsercookies)
maudwisozk@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.
x.com/browsercookies/status/1931028660938789239 — Cookie Connoisseur (@browsercookies)
ramonlopez0322@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
The researcher states these five identities are the same person and says the operator was actively working at several places at the time. The surname is transcribed as McCallla, with three l's, exactly as the post spells it. A screenshot in the thread shows a LinkedIn profile for Rowell Camero placed in Taguig, National Capital Region, Philippines, which is not recorded as an indicator because the post does not give the profile URL in its text.
x.com/browsercookies/status/1931028660938789239 — Cookie Connoisseur (@browsercookies)
https://github.com/boywhocriedwolf
github profile IT Worker Fraud CURATED removed
removed
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 25 commits signed magic.front.68@gmail.com, an address browsercookies publishes for this persona, to the login Magic-Front, which no longer resolves. GitHub attributes 1 commit signed greenfashiondev@gmail.com, an address browsercookies publishes for this persona, to github.com/Yugin89, account id 200094463, created on 20 February 2025, with 5 public repositories. GitHub attributes 100 commits signed hdreamdev@gmail.com, an address browsercookies publishes for this persona, to the login BoyWhoCriedWolf, which no longer resolves.
github.com/BoyWhoCriedWolf — Chollima Hunter
https://github.com/magic-front
github profile IT Worker Fraud CURATED removed
removed
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 25 commits signed magic.front.68@gmail.com, an address browsercookies publishes for this persona, to the login Magic-Front, which no longer resolves. GitHub attributes 1 commit signed greenfashiondev@gmail.com, an address browsercookies publishes for this persona, to github.com/Yugin89, account id 200094463, created on 20 February 2025, with 5 public repositories. GitHub attributes 100 commits signed hdreamdev@gmail.com, an address browsercookies publishes for this persona, to the login BoyWhoCriedWolf, which no longer resolves.
github.com/Magic-Front — Chollima Hunter
https://github.com/yugin89
github profile IT Worker Fraud CURATED live
live
Source
-
Found on 24 September 2026 by searching GitHub's commit index for published persona addresses and reading which account GitHub attributes the commits to. GitHub credits a commit to the account that has the signing address registered and verified, which only the holder of the mailbox can do, so an attributed account is one the address's holder controls, whichever repository the commits sit in and whenever the address was added. Counts are of the commits GitHub's search returns, up to 100. GitHub attributes 25 commits signed magic.front.68@gmail.com, an address browsercookies publishes for this persona, to the login Magic-Front, which no longer resolves. GitHub attributes 1 commit signed greenfashiondev@gmail.com, an address browsercookies publishes for this persona, to github.com/Yugin89, account id 200094463, created on 20 February 2025, with 5 public repositories. GitHub attributes 100 commits signed hdreamdev@gmail.com, an address browsercookies publishes for this persona, to the login BoyWhoCriedWolf, which no longer resolves.
github.com/Yugin89 — Chollima Hunter
Sources
- Unmasking DPRK IT Workers: Email Address Patterns as Hiring Red Flags — The Raven File
- x.com/browsercookies/status/1931028660938789239 — Cookie Connoisseur (@browsercookies)
- x.com/browsercookies/status/1931029205711769690 — Cookie Connoisseur (@browsercookies)
- x.com/browsercookies/status/1931028063015571653 — Cookie Connoisseur (@browsercookies)
- github.com/Magic-Front — Chollima Hunter
- github.com/Yugin89 — Chollima Hunter
- github.com/BoyWhoCriedWolf — Chollima Hunter