`https://www.linkedin.com/in/schmid-payen-17695a120/`

https://www.linkedin.com/in/schmid-payen-17695a120/ is a LinkedIn account that one published source reports in connection with IT Worker Fraud activity, which public reporting attributes to North Korea (DPRK). It is cited here from Hayden McKenzie. The report is dated 2026-09-23.

The reporting files it under the persona Schmid Payen, alongside 3 other identifiers attributed to the same identity. The persona page shows them together with any accounts, photographs and CV recorded under that name. A persona name is the one an account presented under, and may belong to an uninvolved person whose identity was taken.

linkedin profile IT Worker Fraud RESEARCHER POST live checked 2026-09-24

First seen 2026-09-23 · last seen 2026-09-23

live checked 2026-09-24

What this profile claims

Name shown	Schmid Payen
Headline	Software Engineer
Location	New York City Metropolitan Area
Connections	500+
Followers	1,836

Claimed experience

Role	Organisation	Dates
Software Developer	EarthSoft · Full-time Pensacola, Florida, United States · Remote	Jul 2022 - Aug 2026
Full Stack Engineer	Exigo · Contract United States · Remote	Apr 2021 - Jun 2022
Full-stack Developer	CORPSMART · Contract Olympia, Washington, United States	May 2019 - Feb 2021
Software Engineer	Envision Better Health LLC · Full-time West Chester, Pennsylvania, United States	Apr 2015 - Aug 2017
Junior Software Engineer	Bee Mortgage · Full-time Jacksonville, Florida, United States	Feb 2014 - Apr 2015

Read from the live profile on 2026-09-24. Everything in this block is the account's own claim about itself, reproduced as written and not verified.

Source

Hayden McKenzie's report names him as CEO of MageHire and, with high confidence, as the U.S. citizen who fronts the cell's placements: he holds the client relationships, relays one-time codes for the operatives' client accounts, and signed a client's device attestation. McKenzie's alias record gives the address, number and LinkedIn account above. This site's own reading of MageHire (its Florida filing, with him as sole member, and a GitHub account that committed as the operative Leo before taking his name) is on the MageHire indicators. He has not been charged.
haydenmckenzie.com/aliases/schmid+payen — Hayden McKenzie · under “Schmid Payen” · published 2026-09-23 · pulled 2026-09-24

Find this indicator in the index, or see every LinkedIn account this site holds under LinkedIn accounts in the browse listing.

Related indicators

Same persona record: Schmid Payen

Other identifiers the reporting files under the same persona; 2 of 3 are shown.

All 3 on the Schmid Payen page

Cited by the same report: haydenmckenzie.com/aliases/schmid+payen

Hayden McKenzie lists 2 other indicators in this source. 1 are shown, chosen across types.

All 3 indicators from this source