ZEUS

Tony Choi

alias IT Worker Fraud RESEARCHER POST

First seen 2025-04-21 · last seen 2025-04-21

Source

• The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/browsercookies/status/1914448899093467450 — Cookie Connoisseur (@browsercookies) · under “ZEUS / Tony Choi” · published 2025-04-21 · pulled 2026-08-30

ZEUS

alias IT Worker Fraud CURATED

First seen 2025-04-21 · last seen 2026-09-29

Sources

• The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/browsercookies/status/1914448899093467450 — Cookie Connoisseur (@browsercookies) · under “ZEUS / Tony Choi” · published 2025-04-21 · pulled 2026-08-30

• Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under accompany1205, a login the index already carries for this persona on another platform. The profile gives a member-since date of 29 May 2023. It displays "Full-Stack & Blockchain Developer", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.

  gitlab.com/accompany1205 — Chollima Hunter · under “ZEUS” · pulled 2026-09-13

• Read on 20 September 2026 by tallying which GitHub logins have authored commits in the repositories of github.com/accompany1205, an account already held under this persona. sirius1205 has authored sixteen of them. It was registered on 5 January 2023, three weeks after accompany1205 itself, holds one public repository, states no name, no bio, no location and no email address, and follows nobody and is followed by nobody. It shares the numeric suffix 1205 with the account whose repositories it commits in, which is the only thing beyond the commits that ties the two logins together and is a coincidence of naming rather than a value either account publishes. A commit establishes that whoever held that login wrote it, not that one person holds both accounts.

  github.com/sirius1205 — Chollima Hunter · under “ZEUS” · pulled 2026-09-20

• Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (accompany1205) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.

  github.com/apollon282/portfolio/blob/4d312c10cb9730b1abfc208d97d1911d32766948/index.html — Chollima Hunter · under “ZEUS” · published 2025-04-11 · pulled 2026-09-29

accompaniedwithyou@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-04-21 · last seen 2025-04-21

Source

• The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/browsercookies/status/1914448899093467450 — Cookie Connoisseur (@browsercookies) · under “ZEUS / Tony Choi” · published 2025-04-21 · pulled 2026-08-30

cccodechef@gmail.com

email address IT Worker Fraud RESEARCHER POST

Also listed under Takuma Miyake — this value’s page names all of them.

First seen 2025-04-21 · last seen 2025-04-21

Sources

• The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/browsercookies/status/1914451502057529606 — Cookie Connoisseur (@browsercookies) · under “ZEUS / Tony Choi” · published 2025-04-21 · pulled 2026-08-30

• Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. Eight names in that table share one address and one Skype identifier, which is why they are one entry here rather than eight. The telephone number is the one the table gives against the Brian Cook row, on a line that otherwise carries the same Skype identifier as the rest.

  docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “Takuma Miyake / Lionel Grace / Carter Walker / Michael Adams / Liam Lio / Angel Hernandez / Alfred Waris / Brian Cook” · pulled 2026-09-09

choitony9412@gmail.com

email address IT Worker Fraud RESEARCHER POST

First seen 2025-04-21 · last seen 2025-04-21

Source

• The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/browsercookies/status/1914448899093467450 — Cookie Connoisseur (@browsercookies) · under “ZEUS / Tony Choi” · published 2025-04-21 · pulled 2026-08-30

https://github.com/accompany1205

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-04-21 · last seen 2025-04-21

Source

• The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/browsercookies/status/1914448899093467450 — Cookie Connoisseur (@browsercookies) · under “ZEUS / Tony Choi” · published 2025-04-21 · pulled 2026-08-30

https://github.com/apollon282

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-29 · last seen 2026-09-29

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Source

• Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (accompany1205) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.

  github.com/apollon282/portfolio/blob/4d312c10cb9730b1abfc208d97d1911d32766948/index.html — Chollima Hunter · under “ZEUS” · published 2025-04-11 · pulled 2026-09-29

https://github.com/sirius1205

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2026-09-20 · last seen 2026-09-20

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Source

• Read on 20 September 2026 by tallying which GitHub logins have authored commits in the repositories of github.com/accompany1205, an account already held under this persona. sirius1205 has authored sixteen of them. It was registered on 5 January 2023, three weeks after accompany1205 itself, holds one public repository, states no name, no bio, no location and no email address, and follows nobody and is followed by nobody. It shares the numeric suffix 1205 with the account whose repositories it commits in, which is the only thing beyond the commits that ties the two logins together and is a coincidence of naming rather than a value either account publishes. A commit establishes that whoever held that login wrote it, not that one person holds both accounts.

  github.com/sirius1205 — Chollima Hunter · under “ZEUS” · pulled 2026-09-20

https://github.com/zeus-dev919

github profile IT Worker Fraud RESEARCHER POST removed checked 2026-09-02

Also listed under zeus-dev919 — this value’s page names all of them.

First seen 2025-04-21 · last seen 2025-04-21

Sources

• The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/browsercookies/status/1914451502057529606 — Cookie Connoisseur (@browsercookies) · under “ZEUS / Tony Choi” · published 2025-04-21 · pulled 2026-08-30

• Transcribed from the ZEUS-DEV-919 working document, an unsigned compilation published as a Google Doc and linked from a repository on the zeus-dev919 GitHub account. The document describes itself as raw data with no filtering applied and asks a reader to verify every linkage before acting on it, so it is carried here as that compilation's claim and not as a finding of this site. Its persona table pairs each name with the address and Skype identifier the application used. This is the account the whole compilation is built around. The document reads its repositories as publishing the personas, cover letters, resumes and operating procedures the rest of the table is drawn from, and notes the SuperStar moniker as one it says recurs across DPRK accounts. The Drive folder it names is attributed to the address here.

  docs.google.com/document/d/1IdVIzSr5NOi76ugu67Ob3t39K6b4Rz_P7an0Q0M9HWo/edit — ZEUS-DEV-919 working document · under “zeus-dev919 / zeus-dev907 / SuperStar” · pulled 2026-09-09

https://github.com/zeusmystery

github profile IT Worker Fraud RESEARCHER POST live checked 2026-09-02

First seen 2025-04-21 · last seen 2025-04-21

Source

• The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/browsercookies/status/1914448899093467450 — Cookie Connoisseur (@browsercookies) · under “ZEUS / Tony Choi” · published 2025-04-21 · pulled 2026-08-30

https://gitlab.com/accompany1205

gitlab account IT Worker Fraud CURATED live checked 2026-11-08

First seen unknown · last seen unknown

Source

• Found on 13 September 2026 by probing every account handle this site already holds for this operator against GitLab, and read from the profile cited. An active GitLab account exists under accompany1205, a login the index already carries for this persona on another platform. The profile gives a member-since date of 29 May 2023. It displays "Full-Stack & Blockchain Developer", which is a display name rather than a person's name and is recorded here rather than as an alias. The handle is what links this account to the rest; nothing here establishes that one person holds both, and a display name on a profile is a name the account presents, not an identification. The profile's bio, location and links render only in a browser and were not read, so nothing is claimed about them either way.

  gitlab.com/accompany1205 — Chollima Hunter · under “ZEUS” · pulled 2026-09-13

https://t.me/arbuckle34

telegram account IT Worker Fraud CURATED live checked 2026-11-08

First seen 2026-09-29 · last seen 2026-09-29

Source

• Found on 29 September 2026 by searching GitHub's code for the handles this site already holds for the persona (accompany1205) and reading the files that name them: contact blocks, profile READMEs and portfolio data in the persona's own repositories or in repositories that credit its accounts. Each value is cited to the file it was read from. Values in copied templates, client team pages and test data are not carried.

  github.com/apollon282/portfolio/blob/4d312c10cb9730b1abfc208d97d1911d32766948/index.html — Chollima Hunter · under “ZEUS” · published 2025-04-11 · pulled 2026-09-29

https://t.me/compete119

telegram account IT Worker Fraud RESEARCHER POST live checked 2026-11-08

First seen 2025-04-21 · last seen 2025-04-21

Source

• The first post calls this another ZEUS profile and describes the operator as a blockchain developer. The second, from a different thread the same day, ties the address cccodechef@gmail.com back to the GitHub account zeus-dev919. The researcher writes both addresses without a top-level domain, as choitony9412[@]gmail and cccodechef[@]gmail; the screenshot attached to the first post settles the first of them, showing choitony9412@gmail.com in full on the GitHub profile page, and the same completion is applied to the second. That screenshot also carries a portfolio site under the name Tony Choi, whose domain is not visible in the capture. The address accompaniedwithyou@gmail.com is the dominant author on the commits in this account's own GitHub repositories, recovered 2026-09-12; it is the operator's own commit address, not a forked repo's upstream author.

  x.com/browsercookies/status/1914448899093467450 — Cookie Connoisseur (@browsercookies) · under “ZEUS / Tony Choi” · published 2025-04-21 · pulled 2026-08-30