North Korean IT worker cell begins using women as interview fronts

An investigation published on 23 September 2026 found a North Korean IT-worker cell using women as on-camera callers while male developers work off-screen. Researchers who reached the group's Slack workspaces documented persona factories, a U.S. staffing front called MageHire, and operators already placed inside an identity consultancy.

Investigation published 23 September 2026

An independent investigation published on 23 September 2026 found that a North Korean remote IT-worker group is putting women on camera for meetings and interviews while male developers work off-screen. The practice is meant to confuse Western companies that may be checking male contractors.

Researcher McKenzie entered two Slack workspaces used by the cell and recorded the first three weeks of a recruit known as Jasmine: training, persona construction, bulk account production, and her first live interview with a client CEO.

In September 2026, a woman calling herself Jasmine Bell joined a video interview for a U.S. identity-consulting firm that wanted a system administrator skilled in Okta, Azure, and VLAN configuration. Her resume claimed a computer science degree from the National University of Singapore, four infrastructure jobs, and a recent move to Florida. She had been at the front company MageHire for three weeks. Her internal title was caller. She was not writing the technical work.

Internal workspace and public front

mphteam, created 9 June 2023, is internal. It held 27,002 messages and 8 to 15 monthly active users as of 15 September 2026.

MageHire, created 16 July 2022, is the outward staffing front shared with a U.S. facilitator. Members called it the client Slack. It held 190,583 messages and 6 to 10 monthly active users.

mphteam #general listed 33 members. Channels included #english (11 people), #resume (6), #used-real-infos (7), and private team4 (4). Avatars were cartoons or AI images. Duplicate handles included three Victors and two Rakals.

A roster from team lead MP listed people under several countries, with two inactive names placed in Russia. Public resumes used those nationalities. One persona, Kei, was presented as Japanese.

Veterans trained newcomers. A member named Scarlet said she waited ten months for a first live interview. English study material posted in #english in March 2025 was six scripts from the sitcom Friends.

Account factory

Jasmine's onboarding ran in team4 under a trainer called Dark. Materials covered bulk applications, LinkedIn inboxes, persona consistency across accounts, ChatGPT for bios and interview lines, the ixBrowser anti-detect browser, SlyNumber for SMS checks, interview rehearsal including the MockWise AI interview service, and cryptocurrency wallets. She had to pick a name from MP's list. She chose Jasmine Bell and aligned a Gmail display name because the local part started with jb.

Written persona rules: choose a large city and a real residential address; build four jobs in that metro area; do not list U.S. employers; use the title Senior Full Stack AI Engineer; add a university with an IT programme; list only technologies that existed before each job date.

One primary mailbox mapped to one LinkedIn account. Jasmine placed more than 20 Outlook accounts behind one Gmail until Microsoft required a phone number. Profiles sat in separate ixBrowser instances with metered proxies. Some services were paid in cryptocurrency. The workspace also contained stolen card data with a Louisiana billing address.

A shared sheet after two weeks listed 1,226 prepared personas, 57 Outlook accounts, and 15 LinkedIn accounts across Finland (642 personas), Poland (103), the Netherlands (100), the United Kingdom (99), Australia (88), Estonia (83), the United States (61), and Japan (50). Birth years ran from 1995 to 1998. Country sheets contained only female personas. Japanese rows included romanised names, Americanised surnames, and a Feeling column. A ninth sheet, US_REAL, stored records for three real U.S. women, including a Jasmine in Jacksonville, Florida, whose personal mailbox contained bell. That record supplied the Bell persona. On 7 September 2026, four finished LinkedIn accounts were banned. Internal slang for rebuilding accounts is injogogi spirit.

Dark told Jasmine that obtaining a willing foreign helper meant approaching a man and drawing him in. Prior reporting by McKenzie called such U.S. helpers real guys.

MageHire, hours, and a placed client

MageHire presents as a staffing firm. Listed CEO Schmid Payen is a U.S. citizen in New York. Another Payen, Rodrigue (@Rio), also appears. In July 2025 Payen told the workspace he had become a father.

Daily check-ins listed client meetings so the CEO could book new calls on weekdays. A team lead proposed an 08:40 standup. Members reassigned meetings when they could not attend.

One developer's billed hours: June 2026, 10 total; July, 20; August, 56 across four clients.

A client anonymised as Company A, an identity and access management consultancy, already had two operators inside the project (joy.huang@ and kei.haruto@). The client's Slack told staff to use the title IAM Engineer. During a move from Microsoft to Okta and Google, MageHire's CEO relayed one-time codes because the second factor landed on his phone. A device attestation form dated 6 August 2026 used the CEO's name and a 16-inch MacBook Pro. Chat logs also showed AnyDesk remote-desktop failures.

Company A then asked MageHire for a two-month system administrator covering Okta, NinjaOne patching, Azure, and Meraki VLANs. On 31 August it asked about Microsoft tenant-to-tenant migration. The CEO claimed coverage. Jasmine was told to write a resume to those requirements. She built it on FlowCV on 3 September 2026, mapping Okta, NinjaOne, Azure, Meraki VLAN, Microsoft 365, and Entra ID onto four Singapore jobs (NCS Group intern, 2018 to 2019; PatSnap, 2019 to 2021; ST Engineering, 2021 to 2024; Win-Pro Consultancy, 2024 to 2026) and a National University of Singapore computer science degree.

The investigation describes labour fraud and insertion into identity-administration work, not a software CVE. Firms hiring remote identity administrators should treat video-only interviews, staffing vendors with inconsistent public records, and device attestation that does not match the worker as warning signs.