Rascal
A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Rascal. The attribution is theirs, not this site's.
Identifiers attributed to this persona
2 indicators the source attributes to this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
Rascal |
alias | |
wangtiendev@gmail.com |
email address |
Rascal
alias IT Worker Fraud RESEARCHER POST
Source
-
Rascal is not a public persona but the display name of one account on luckyguys.site, the internal North Korean remittance platform whose data the researcher obtained; the entry exists because that display name and the address below are facts about an account rather than a claim about a person. The thread shows the account's private messages with the server administrator PC-1234, running from December 2025 to April 2026 and covering payment transfers and the use of fraudulent identities, and in one of them the account writes "This is Mexc account details" and gives this address. What it sends in the same line -- the credential and the recovery string for that exchange account -- is deliberately not recorded here or anywhere else in this repository. Another screenshot in the thread shows the account submitting a photograph of an Irish passport cover to the administrator to pass an identity check; no name on it is legible.
x.com/zachxbt/status/2041873518577774708 — ZachXBT (@zachxbt)
wangtiendev@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
Rascal is not a public persona but the display name of one account on luckyguys.site, the internal North Korean remittance platform whose data the researcher obtained; the entry exists because that display name and the address below are facts about an account rather than a claim about a person. The thread shows the account's private messages with the server administrator PC-1234, running from December 2025 to April 2026 and covering payment transfers and the use of fraudulent identities, and in one of them the account writes "This is Mexc account details" and gives this address. What it sends in the same line -- the credential and the recovery string for that exchange account -- is deliberately not recorded here or anywhere else in this repository. Another screenshot in the thread shows the account submitting a photograph of an Irish passport cover to the administrator to pass an identity check; no name on it is legible.
x.com/zachxbt/status/2041873521601868112 — ZachXBT (@zachxbt)
Sources
- x.com/zachxbt/status/2041873521601868112 — ZachXBT (@zachxbt)
- x.com/zachxbt/status/2041873518577774708 — ZachXBT (@zachxbt)