Xun Lee

A fabricated professional identity used in the DPRK remote IT-worker scheme. Everything below is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, Xun Lee. The attribution is theirs, not this site's.

IT Worker Fraud First reported 2025-06-15

Profiles and evidence

Identifiers attributed to this persona

1 indicator the source attributes to this operator, each with its sources.

IndicatorTypeAccount status
Xun Lee alias —

Xun Lee

alias IT Worker Fraud RESEARCHER POST

First seen 2025-06-15 · last seen 2025-06-15

Source

  • A composite image matching two freelancer profile photographs against faces in a crowd photograph taken in North Korea. One profile carries this name on freelancermap.de; the other is a senior software engineer listing giving Rowlett, Texas and a UTC-05:00 timezone, with the name withheld by the platform. The face matching is the researcher's evidence rather than a value, and the composite is not mirrored here because it shows people in a crowd who are not accused of anything.
    x.com/browsercookies/status/1934302099258716572 — Cookie Connoisseur (@browsercookies) · under “Xun Lee” · published 2025-06-15 · pulled 2026-08-30

Sources

Back to all personas

Disclaimer An entry here is not proof of DPRK affiliation or wrongdoing. A listed name, account or address may belong to an uninvolved person, so each entry is a lead to verify independently. What inclusion means. Xun Lee as the name of the operator is the cited researcher’s assertion, repeated here as their claim.