Schmid Payen

Schmid Payen

alias IT Worker Fraud RESEARCHER POST

First seen 2026-09-23 · last seen 2026-09-23

Source

• Hayden McKenzie's report names him as CEO of MageHire and, with high confidence, as the U.S. citizen who fronts the cell's placements: he holds the client relationships, relays one-time codes for the operatives' client accounts, and signed a client's device attestation. McKenzie's alias record gives the address, number and LinkedIn account above. This site's own reading of MageHire (its Florida filing, with him as sole member, and a GitHub account that committed as the operative Leo before taking his name) is on the MageHire indicators. He has not been charged.

  haydenmckenzie.com/research/dprk-it-worker-cell-part-one — Hayden McKenzie · under “Schmid Payen” · published 2026-09-23 · pulled 2026-09-24

schmid@magehire.com

email address IT Worker Fraud CURATED

First seen 2026-09-23 · last seen 2026-09-23

Sources

• Hayden McKenzie's report names him as CEO of MageHire and, with high confidence, as the U.S. citizen who fronts the cell's placements: he holds the client relationships, relays one-time codes for the operatives' client accounts, and signed a client's device attestation. McKenzie's alias record gives the address, number and LinkedIn account above. This site's own reading of MageHire (its Florida filing, with him as sole member, and a GitHub account that committed as the operative Leo before taking his name) is on the MageHire indicators. He has not been charged.

  haydenmckenzie.com/aliases/schmid+payen — Hayden McKenzie · under “Schmid Payen” · published 2026-09-23 · pulled 2026-09-24

• MageHire is the front company in Hayden McKenzie's report The Women Behind North Korea's IT Worker Operations (https://haydenmckenzie.com/research/dprk-it-worker-cell-part-one), which places its team leader, Leo, in Dalian and says he is presented publicly as its CTO. magehire.com lists a Leo King as CTO and links github.com/goldengm. That account (id 55405956, created 16 September 2019) committed as Leo, leokokko1022@gmail.com and leokokko@outlook.com, under the former login leokokko, until December 2019, and as the company's CEO from 22 December 2019; it now carries his name and schmid@magehire.com. leokokko@outlook.com is also verified on github.com/goldencode8. The phone number is the sales line magehire.com publishes. Read 23 September 2026. goldengm and two accounts follow each other: schmidpeterley (display name the CEO's, created March 2021) and maxvmiracle (display name Joy, maxvman92@gmail.com, created July 2025, following nobody else). The report names an operative Joy. banksbestrates (David Goodman, Banks Best Rates, Inc.) follows goldengm and is the source named on a testimonial on magehire.com's 2023 homepage; banksbestrates.com is a parked domain with no archived history. Read 24 September 2026. Registries, read 24 September 2026: New York holds no entity named MageHire or Mage Hire, despite the Wall Street address the site gives. Florida holds MAGE HIRE LLC (M20000008674), a Delaware LLC registered 2 October 2020 at 1415 2nd St, Sarasota, with the CEO as sole member and registered agent, revoked on 23 September 2022 for a missed annual report. goldengm/goldengm-git, created 19 June 2024, holds 362 commits by Pookie0717 (pookiemoney717@gmail.com), every one titled "fake commit" and dated back to April, beside the CEO's own README: a contribution graph being padded inside the company account's repository. Pookie0717 also re-published a client codebase whose history is the CEO account's commits. A second account, Pookie717 (named Pookie, created September 2023), holds a repository with commits GitHub credits to goldengm.

  github.com/goldengm — Chollima Hunter · under “MageHire, the staffing company a report assesses as a DPRK IT worker cell's front” · pulled 2026-09-23

+19415807652

phone number IT Worker Fraud CURATED

First seen 2026-09-23 · last seen 2026-09-23

Line type

Looked up 2026-09-30 at phonevalidator.com. This is a lookup of the line itself.

Sources

• Hayden McKenzie's report names him as CEO of MageHire and, with high confidence, as the U.S. citizen who fronts the cell's placements: he holds the client relationships, relays one-time codes for the operatives' client accounts, and signed a client's device attestation. McKenzie's alias record gives the address, number and LinkedIn account above. This site's own reading of MageHire (its Florida filing, with him as sole member, and a GitHub account that committed as the operative Leo before taking his name) is on the MageHire indicators. He has not been charged.

  haydenmckenzie.com/aliases/schmid+payen — Hayden McKenzie · under “Schmid Payen” · published 2026-09-23 · pulled 2026-09-24

• MageHire is the front company in Hayden McKenzie's report The Women Behind North Korea's IT Worker Operations (https://haydenmckenzie.com/research/dprk-it-worker-cell-part-one), which places its team leader, Leo, in Dalian and says he is presented publicly as its CTO. magehire.com lists a Leo King as CTO and links github.com/goldengm. That account (id 55405956, created 16 September 2019) committed as Leo, leokokko1022@gmail.com and leokokko@outlook.com, under the former login leokokko, until December 2019, and as the company's CEO from 22 December 2019; it now carries his name and schmid@magehire.com. leokokko@outlook.com is also verified on github.com/goldencode8. The phone number is the sales line magehire.com publishes. Read 23 September 2026. goldengm and two accounts follow each other: schmidpeterley (display name the CEO's, created March 2021) and maxvmiracle (display name Joy, maxvman92@gmail.com, created July 2025, following nobody else). The report names an operative Joy. banksbestrates (David Goodman, Banks Best Rates, Inc.) follows goldengm and is the source named on a testimonial on magehire.com's 2023 homepage; banksbestrates.com is a parked domain with no archived history. Read 24 September 2026. Registries, read 24 September 2026: New York holds no entity named MageHire or Mage Hire, despite the Wall Street address the site gives. Florida holds MAGE HIRE LLC (M20000008674), a Delaware LLC registered 2 October 2020 at 1415 2nd St, Sarasota, with the CEO as sole member and registered agent, revoked on 23 September 2022 for a missed annual report. goldengm/goldengm-git, created 19 June 2024, holds 362 commits by Pookie0717 (pookiemoney717@gmail.com), every one titled "fake commit" and dated back to April, beside the CEO's own README: a contribution graph being padded inside the company account's repository. Pookie0717 also re-published a client codebase whose history is the CEO account's commits. A second account, Pookie717 (named Pookie, created September 2023), holds a repository with commits GitHub credits to goldengm.

  magehire.com/about/leo-king https://magehire.com/about/leo-king not linked — Chollima Hunter · under “MageHire, the staffing company a report assesses as a DPRK IT worker cell's front” · pulled 2026-09-23