`magehiregroup.slack.com`

magehiregroup.slack.com is a domain that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Hayden McKenzie. The report is dated 2026-09-23.

domain IT Worker Fraud RESEARCHER POST

First seen 2026-09-23 · last seen 2026-09-23

Source

The two free-plan Slack workspaces the report The Women Behind North Korea's IT Worker Operations lists in its indicator register. The author reports joining both through social engineering. mphteam is described as the cell's internal workspace, with every member North Korean; MageHire is the front-facing workspace shared with the staffing company the report assesses as the cell's front, where job profiles, interviews and placements are run. They belong to the cell rather than to any one persona, so they anchor none. The report's register adds that listing a service there means it was observed in use, not that the provider is implicated.
haydenmckenzie.com/research/dprk-it-worker-cell-part-one — Hayden McKenzie · under “Slack workspaces of a DPRK IT worker cell” · published 2026-09-23 · pulled 2026-09-23

Find this indicator in the index, or see every domain this site holds under Domains in the browse listing.

Related indicators

Cited by the same report: haydenmckenzie.com/research/dprk-it-worker-cell-part-one

Hayden McKenzie lists 7 other indicators in this source.