Michal Jankowski
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Michal Jankowski. The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Identifiers attributed to this persona
8 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Michal Jankowski |
alias | |
michaljankowski003@gmail.com |
email address | |
https://github.com/michaljankowsk |
github profile | live |
https://github.com/nmdev0217 |
github profile | removed |
jankowski.vercel.app |
hosted site | |
+3584573985503 |
phone number | |
+48228472622 |
phone number | |
https://t.me/jankowskimichal |
telegram account | live |
Michal Jankowski
alias IT Worker Fraud CURATED
Sources
-
Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Warsaw, Poland, the role it presents as Senior Elixir/Go Software Engineer, and the contact details above. The record is one of two tied to the second report, Dissecting the Identity Lifecycle, and the only record in the set naming a GitHub account. The account MichalJankowsk exists, created 6 October 2023 and holding nine public repositories when it was checked on 22 September 2026; the personal site on a free Vercel subdomain answered the same day. Neither was read further here, and the association is the one the alias page makes. The alias pages carry no date of their own, so the date cited is the site's own "Updated 19 Aug 2026" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a number and a Telegram account drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/michal+jankowski — Hayden McKenzie -
Read 24 September 2026. The persona's site links github.com/nmdev0217, now deleted, rather than the MichalJankowsk account Hayden McKenzie gives. MichalJankowsk (created 6 October 2023) signs its own commits michal.jankowski003@gmail.com. Its repository Vpn-Valut, created 23 October 2023, carries April and May 2023 merges re-signed with that address over another developer's pull requests, and on 5 July 2024 it merged two commits signed by the Larry Levine persona, larrylevine312@gmail.com: the two personas working in one repository.
jankowski.vercel.app/https://jankowski.vercel.app/— Chollima Hunter
michaljankowski003@gmail.com
email address IT Worker Fraud CURATED
Sources
-
Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Warsaw, Poland, the role it presents as Senior Elixir/Go Software Engineer, and the contact details above. The record is one of two tied to the second report, Dissecting the Identity Lifecycle, and the only record in the set naming a GitHub account. The account MichalJankowsk exists, created 6 October 2023 and holding nine public repositories when it was checked on 22 September 2026; the personal site on a free Vercel subdomain answered the same day. Neither was read further here, and the association is the one the alias page makes. The alias pages carry no date of their own, so the date cited is the site's own "Updated 19 Aug 2026" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a number and a Telegram account drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/michal+jankowski — Hayden McKenzie -
Read 24 September 2026. The persona's site links github.com/nmdev0217, now deleted, rather than the MichalJankowsk account Hayden McKenzie gives. MichalJankowsk (created 6 October 2023) signs its own commits michal.jankowski003@gmail.com. Its repository Vpn-Valut, created 23 October 2023, carries April and May 2023 merges re-signed with that address over another developer's pull requests, and on 5 July 2024 it merged two commits signed by the Larry Levine persona, larrylevine312@gmail.com: the two personas working in one repository.
github.com/MichalJankowsk/Vpn-Valut — Chollima Hunter
https://github.com/michaljankowsk
github profile IT Worker Fraud CURATED live
live
Sources
-
Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Warsaw, Poland, the role it presents as Senior Elixir/Go Software Engineer, and the contact details above. The record is one of two tied to the second report, Dissecting the Identity Lifecycle, and the only record in the set naming a GitHub account. The account MichalJankowsk exists, created 6 October 2023 and holding nine public repositories when it was checked on 22 September 2026; the personal site on a free Vercel subdomain answered the same day. Neither was read further here, and the association is the one the alias page makes. The alias pages carry no date of their own, so the date cited is the site's own "Updated 19 Aug 2026" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a number and a Telegram account drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/michal+jankowski — Hayden McKenzie -
Read 24 September 2026. The persona's site links github.com/nmdev0217, now deleted, rather than the MichalJankowsk account Hayden McKenzie gives. MichalJankowsk (created 6 October 2023) signs its own commits michal.jankowski003@gmail.com. Its repository Vpn-Valut, created 23 October 2023, carries April and May 2023 merges re-signed with that address over another developer's pull requests, and on 5 July 2024 it merged two commits signed by the Larry Levine persona, larrylevine312@gmail.com: the two personas working in one repository.
github.com/MichalJankowsk/Vpn-Valut — Chollima Hunter
https://github.com/nmdev0217
github profile IT Worker Fraud CURATED removed
removed
Source
-
Read 24 September 2026. The persona's site links github.com/nmdev0217, now deleted, rather than the MichalJankowsk account Hayden McKenzie gives. MichalJankowsk (created 6 October 2023) signs its own commits michal.jankowski003@gmail.com. Its repository Vpn-Valut, created 23 October 2023, carries April and May 2023 merges re-signed with that address over another developer's pull requests, and on 5 July 2024 it merged two commits signed by the Larry Levine persona, larrylevine312@gmail.com: the two personas working in one repository.
jankowski.vercel.app/https://jankowski.vercel.app/— Chollima Hunter
jankowski.vercel.app
hosted site IT Worker Fraud RESEARCHER POST
Source
-
Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Warsaw, Poland, the role it presents as Senior Elixir/Go Software Engineer, and the contact details above. The record is one of two tied to the second report, Dissecting the Identity Lifecycle, and the only record in the set naming a GitHub account. The account MichalJankowsk exists, created 6 October 2023 and holding nine public repositories when it was checked on 22 September 2026; the personal site on a free Vercel subdomain answered the same day. Neither was read further here, and the association is the one the alias page makes. The alias pages carry no date of their own, so the date cited is the site's own "Updated 19 Aug 2026" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a number and a Telegram account drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/michal+jankowski — Hayden McKenzie
+3584573985503
phone number IT Worker Fraud RESEARCHER POST
Line type
| Line type | Wireless |
|---|---|
| Carrier | ALANDS MOBILTELEFON |
| Rate centre | FINLAND |
Source
-
Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Warsaw, Poland, the role it presents as Senior Elixir/Go Software Engineer, and the contact details above. The record is one of two tied to the second report, Dissecting the Identity Lifecycle, and the only record in the set naming a GitHub account. The account MichalJankowsk exists, created 6 October 2023 and holding nine public repositories when it was checked on 22 September 2026; the personal site on a free Vercel subdomain answered the same day. Neither was read further here, and the association is the one the alias page makes. The alias pages carry no date of their own, so the date cited is the site's own "Updated 19 Aug 2026" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a number and a Telegram account drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/michal+jankowski — Hayden McKenzie
+48228472622
phone number IT Worker Fraud RESEARCHER POST
Line type
| Line type | Landline |
|---|---|
| Carrier | ORANGE POLSKA |
| Rate centre | WARSAW |
Source
-
Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Warsaw, Poland, the role it presents as Senior Elixir/Go Software Engineer, and the contact details above. The record is one of two tied to the second report, Dissecting the Identity Lifecycle, and the only record in the set naming a GitHub account. The account MichalJankowsk exists, created 6 October 2023 and holding nine public repositories when it was checked on 22 September 2026; the personal site on a free Vercel subdomain answered the same day. Neither was read further here, and the association is the one the alias page makes. The alias pages carry no date of their own, so the date cited is the site's own "Updated 19 Aug 2026" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a number and a Telegram account drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/michal+jankowski — Hayden McKenzie
https://t.me/jankowskimichal
telegram account IT Worker Fraud RESEARCHER POST live
live
Source
-
Hayden McKenzie publishes this as one of the aliases tracked across the three investigations the site cites, on a per-alias record that gives its location as Warsaw, Poland, the role it presents as Senior Elixir/Go Software Engineer, and the contact details above. The record is one of two tied to the second report, Dissecting the Identity Lifecycle, and the only record in the set naming a GitHub account. The account MichalJankowsk exists, created 6 October 2023 and holding nine public repositories when it was checked on 22 September 2026; the personal site on a free Vercel subdomain answered the same day. Neither was read further here, and the association is the one the alias page makes. The alias pages carry no date of their own, so the date cited is the site's own "Updated 19 Aug 2026" stamp, the last date it states anything was published. When the site published its fourth report on 23 September 2026 the record grew by a number and a Telegram account drawn from the persona's own working files, cited to that date. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/michal+jankowski — Hayden McKenzie
Sources
- haydenmckenzie.com/aliases/michal+jankowski — Hayden McKenzie
-
jankowski.vercel.app/
https://jankowski.vercel.app/— Chollima Hunter - github.com/MichalJankowsk/Vpn-Valut — Chollima Hunter