`https://github.com/banksbestrates`

https://github.com/banksbestrates is a GitHub account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Chollima Hunter. The report is dated 2023-03-20.

github profile IT Worker Fraud CURATED live checked 2026-09-30

First seen 2023-03-20 · last seen 2023-03-20

live checked 2026-09-30

The image is the avatar this account displays, not evidence of who operates it.

Source

MageHire is the front company in Hayden McKenzie's report The Women Behind North Korea's IT Worker Operations (https://haydenmckenzie.com/research/dprk-it-worker-cell-part-one), which places its team leader, Leo, in Dalian and says he is presented publicly as its CTO. magehire.com lists a Leo King as CTO and links github.com/goldengm. That account (id 55405956, created 16 September 2019) committed as Leo, leokokko1022@gmail.com and leokokko@outlook.com, under the former login leokokko, until December 2019, and as the company's CEO from 22 December 2019; it now carries his name and schmid@magehire.com. leokokko@outlook.com is also verified on github.com/goldencode8. The phone number is the sales line magehire.com publishes. Read 23 September 2026. goldengm and two accounts follow each other: schmidpeterley (display name the CEO's, created March 2021) and maxvmiracle (display name Joy, maxvman92@gmail.com, created July 2025, following nobody else). The report names an operative Joy. banksbestrates (David Goodman, Banks Best Rates, Inc.) follows goldengm and is the source named on a testimonial on magehire.com's 2023 homepage; banksbestrates.com is a parked domain with no archived history. Read 24 September 2026. Registries, read 24 September 2026: New York holds no entity named MageHire or Mage Hire, despite the Wall Street address the site gives. Florida holds MAGE HIRE LLC (M20000008674), a Delaware LLC registered 2 October 2020 at 1415 2nd St, Sarasota, with the CEO as sole member and registered agent, revoked on 23 September 2022 for a missed annual report. goldengm/goldengm-git, created 19 June 2024, holds 362 commits by Pookie0717 (pookiemoney717@gmail.com), every one titled "fake commit" and dated back to April, beside the CEO's own README: a contribution graph being padded inside the company account's repository. Pookie0717 also re-published a client codebase whose history is the CEO account's commits. A second account, Pookie717 (named Pookie, created September 2023), holds a repository with commits GitHub credits to goldengm.
web.archive.org/web/20230320131401/https://www.magehire.com/ — Chollima Hunter · under “MageHire, the staffing company a report assesses as a DPRK IT worker cell's front” · published 2023-03-20 · pulled 2026-09-23

Find this indicator in the index, or see every GitHub account this site holds under GitHub accounts in the browse listing.

Account analysis

Account created	2020-04-03
Repositories	2 original, 0 forked
History older than the account	0 repositories
Commits copied into others' repositories	0
Commit identities	0 addresses, 1 name

Follows these indexed accounts

From gh-fake-analyzer 1.0.2, the Ketman Project's GitHub analysis tool, run on 2026-10-27. These are signals: backdated history and several commit identities are common among ordinary developers too, and an account that shows none of them is not thereby cleared.