NK Internet tracks a DPRK-style fake developer and company cluster that pivoted after earlier Mentonex-related accounts and companies were taken down. The investigation connects Nixsora.com and GitHub personas such as vexxloso, trader389, walletdiscover1010-a11y, recruiter-test, and lightart732059 through reused profile imagery, follower relationships, seeded community content, blockchain developer job postings, and Dev.to activity around a sports-card project. The post compares the Mentonex Slack setup with other DPRK social-engineering tradecraft in which attackers clone legitimate company identities and create plausible Slack workspaces to build trust. No malicious code was found in the reviewed repositories, but the infrastructure and personas appear positioned for a broader developer recruitment campaign focused on blockchain workers.