schmid@magehire.com
schmid@magehire.com is an email address
that 2 published sources report
in connection with IT Worker Fraud activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from Hayden McKenzie and Chollima Hunter.
The reports are dated 2026-09-23.
The reporting files it under the persona Schmid Payen, alongside 3 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.
email address IT Worker Fraud CURATED
Sources
-
Hayden McKenzie's report names him as CEO of MageHire and, with high confidence, as the U.S. citizen who fronts the cell's placements: he holds the client relationships, relays one-time codes for the operatives' client accounts, and signed a client's device attestation. McKenzie's alias record gives the address, number and LinkedIn account above. This site's own reading of MageHire (its Florida filing, with him as sole member, and a GitHub account that committed as the operative Leo before taking his name) is on the MageHire indicators. He has not been charged.
haydenmckenzie.com/aliases/schmid+payen — Hayden McKenzie -
MageHire is the front company in Hayden McKenzie's report The Women Behind North Korea's IT Worker Operations (https://haydenmckenzie.com/research/dprk-it-worker-cell-part-one), which places its team leader, Leo, in Dalian and says he is presented publicly as its CTO. magehire.com lists a Leo King as CTO and links github.com/goldengm. That account (id 55405956, created 16 September 2019) committed as Leo, leokokko1022@gmail.com and leokokko@outlook.com, under the former login leokokko, until December 2019, and as the company's CEO from 22 December 2019; it now carries his name and schmid@magehire.com. leokokko@outlook.com is also verified on github.com/goldencode8. The phone number is the sales line magehire.com publishes. Read 23 September 2026. goldengm and two accounts follow each other: schmidpeterley (display name the CEO's, created March 2021) and maxvmiracle (display name Joy, maxvman92@gmail.com, created July 2025, following nobody else). The report names an operative Joy. banksbestrates (David Goodman, Banks Best Rates, Inc.) follows goldengm and is the source named on a testimonial on magehire.com's 2023 homepage; banksbestrates.com is a parked domain with no archived history. Read 24 September 2026. Registries, read 24 September 2026: New York holds no entity named MageHire or Mage Hire, despite the Wall Street address the site gives. Florida holds MAGE HIRE LLC (M20000008674), a Delaware LLC registered 2 October 2020 at 1415 2nd St, Sarasota, with the CEO as sole member and registered agent, revoked on 23 September 2022 for a missed annual report. goldengm/goldengm-git, created 19 June 2024, holds 362 commits by Pookie0717 (pookiemoney717@gmail.com), every one titled "fake commit" and dated back to April, beside the CEO's own README: a contribution graph being padded inside the company account's repository. Pookie0717 also re-published a client codebase whose history is the CEO account's commits. A second account, Pookie717 (named Pookie, created September 2023), holds a repository with commits GitHub credits to goldengm.
github.com/goldengm — Chollima Hunter
Find this indicator in the index, or see every email address this site holds under Email addresses in the browse listing.
Related indicators
Same persona record: Schmid Payen
All 3 on the Schmid Payen page
Cited by the same report: haydenmckenzie.com/aliases/schmid+payen
All 3 indicators from this source