zeus-dev919

SuperStar

alias IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

• Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. This is the account the whole compilation is built around. The document reads its repositories as publishing the personas, cover letters, resumes and operating procedures the rest of the table is drawn from, and notes the SuperStar moniker as one it says recurs across DPRK accounts. The Drive folder it names is attributed to the address here.

  docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “zeus-dev919 / zeus-dev907 / SuperStar” · pulled 2026-09-09

angelhernandez919919@gmail.com

email address IT Worker Fraud THIRD-PARTY REGISTRY

First seen unknown · last seen unknown

Source

• Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. This is the account the whole compilation is built around. The document reads its repositories as publishing the personas, cover letters, resumes and operating procedures the rest of the table is drawn from, and notes the SuperStar moniker as one it says recurs across DPRK accounts. The Drive folder it names is attributed to the address here.

  docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “zeus-dev919 / zeus-dev907 / SuperStar” · pulled 2026-09-09

https://github.com/zeus-dev907

github profile IT Worker Fraud THIRD-PARTY REGISTRY live checked 2026-09-30

First seen unknown · last seen unknown

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Source

• Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. This is the account the whole compilation is built around. The document reads its repositories as publishing the personas, cover letters, resumes and operating procedures the rest of the table is drawn from, and notes the SuperStar moniker as one it says recurs across DPRK accounts. The Drive folder it names is attributed to the address here.

  docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “zeus-dev919 / zeus-dev907 / SuperStar” · pulled 2026-09-09

https://github.com/zeus-dev919

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-02

Also listed under ZEUS — this value’s page names all of them.

First seen 2025-04-21 · last seen 2025-04-21

Sources

• The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/browsercookies/status/1914451502057529606 — Cookie Connoisseur (@browsercookies) · under “ZEUS / Tony Choi” · published 2025-04-21 · pulled 2026-08-30

• Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. This is the account the whole compilation is built around. The document reads its repositories as publishing the personas, cover letters, resumes and operating procedures the rest of the table is drawn from, and notes the SuperStar moniker as one it says recurs across DPRK accounts. The Drive folder it names is attributed to the address here.

  docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “zeus-dev919 / zeus-dev907 / SuperStar” · pulled 2026-09-09