Schmid Payen
Schmid Payen is an alias
that one published source reports
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Hayden McKenzie.
The report is dated 2026-09-23.
The reporting files it under the persona Schmid Payen, alongside 3 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
alias IT Worker Fraud RESEARCHER POST
Source
-
Hayden McKenzie's report names him as CEO of MageHire and, with high confidence, as the U.S. citizen who fronts the cell's placements: he holds the client relationships, relays one-time codes for the operatives' client accounts, and signed a client's device attestation. McKenzie's alias record gives the address, number and LinkedIn account above. This site's own reading of MageHire (its Florida filing, with him as sole member, and a GitHub account that committed as the operative Leo before taking his name) is on the MageHire indicators. He has not been charged.
haydenmckenzie.com/research/dprk-it-worker-cell-part-one — Hayden McKenzie
Find this indicator in the index, or see every alias this site holds under Aliases in the browse listing.