David (Hayden McKenzie)
A fabricated professional identity used in the DPRK remote IT-worker scheme. Most of what follows is transcribed from the cited post, in which a named researcher attributes these accounts to a single operator, David (Hayden McKenzie). The attribution is theirs, not this site's.
The remainder was read by this site from the account itself and is cited to the page and date it was read.
Identifiers attributed to this persona
4 indicators the sources below record for this operator, each with its sources.
| Indicator | Type | Account status |
|---|---|---|
david10547@gmail.com |
email address | |
davim10547@gmail.com |
email address | |
https://github.com/superdev0312 |
github profile | removed |
+3584573986537 |
phone number |
david10547@gmail.com
email address IT Worker Fraud RESEARCHER POST
Source
-
Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that lists the contact details above. The record adds a mailbox from the persona's working files. The record gives a first name only, so it is labelled with its publisher here: persona pages on this site join entries by name, and an unrelated David from another researcher would otherwise merge with it. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/david — Hayden McKenzie
davim10547@gmail.com
email address IT Worker Fraud CURATED
Sources
-
Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that lists the contact details above. The record adds a mailbox from the persona's working files. The record gives a first name only, so it is labelled with its publisher here: persona pages on this site join entries by name, and an unrelated David from another researcher would otherwise merge with it. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/david — Hayden McKenzie -
Read 2026-09-24 by searching GitHub commits for the persona's address. GitHub credited commits signed davim10547@gmail.com, the persona's second mailbox, to SuperDev0312. The account has since been deleted.
github.com/search?q=author-email%3Adavim10547%40gmail.com&type=commits — Chollima Hunter
https://github.com/superdev0312
github profile IT Worker Fraud CURATED removed
removed
Source
-
Read 2026-09-24 by searching GitHub commits for the persona's address. GitHub credited commits signed davim10547@gmail.com, the persona's second mailbox, to SuperDev0312. The account has since been deleted.
github.com/search?q=author-email%3Adavim10547%40gmail.com&type=commits — Chollima Hunter
+3584573986537
phone number IT Worker Fraud RESEARCHER POST
Line type
| Line type | Wireless |
|---|---|
| Carrier | ALANDS MOBILTELEFON |
| Rate centre | FINLAND |
Source
-
Hayden McKenzie publishes this as one of the aliases recovered from a DPRK IT worker cell's own files, on a per-alias record that lists the contact details above. The record adds a mailbox from the persona's working files. The record gives a first name only, so it is labelled with its publisher here: persona pages on this site join entries by name, and an unrelated David from another researcher would otherwise merge with it. The record was not on the site when this one first read it on 22 September 2026 and appeared alongside the report The Women Behind North Korea's IT Worker Operations, published on 23 September, so that is the date cited. The name is the identity the operation presents, not the operator's; a real person whose name or details it may have been assembled from is not the worker.
haydenmckenzie.com/aliases/david — Hayden McKenzie
Sources
- haydenmckenzie.com/aliases/david — Hayden McKenzie
- github.com/search?q=author-email%3Adavim10547%40gmail.com&type=commits — Chollima Hunter