> [!hm-nav] > **![Hayden McKenzie's 007 Minion profile picture](Attachments/007-minion.png) [[Home|HAYDEN MCKENZIE]]** [[Home|Home]] [[Research|Research]] [[Indicators|Indicators]] [[About|About]] # Indicator data Copy the data below into a file named `indicators.csv` to use it in a spreadsheet. [[Indicators|Back to the indicator register ↗]] ```csv category,indicator,role,reports,last_updated Victim selection and identity sourcing,LinkedIn,Primary victim-sourcing pool. Searched by common American name and developer title; profiles without photographs explicitly preferred,"P1, P2",19 Aug 2026 Victim selection and identity sourcing,TruthFinder,Background report on the selected victim. Premium account sourced from a broker at $55/month,P2,19 Aug 2026 Victim selection and identity sourcing,Intelius,"Address history, relatives, employment, and court records on the selected victim",P2,19 Aug 2026 Victim selection and identity sourcing,FastPeopleSearch,Free-tier initial confirmation of a candidate identity,P2,19 Aug 2026 Victim selection and identity sourcing,upworksell[.]com,Historical marketplace for stolen identities and pre-built freelance accounts. Seized 2024-05-16,P2,19 Aug 2026 Victim selection and identity sourcing,Telegram,"Broker contact, identity purchase, and aged-account supply",P2,19 Aug 2026 Victim selection and identity sourcing,Discord,"Bidder recruitment, persona handover, facilitator solicitation, and aged LinkedIn account supply","P1, P2, OL",19 Aug 2026 Identity validation,ssn-check[.]org,"Public SSN validation, used to confirm a purchased number is structurally valid and issued",P2,19 Aug 2026 Identity validation,State DMV self-service portals,"Confirming a purchased driver's licence number is live before spending on documents. Ten states listed: TX, MI, SC, AL, NY, KS, MD, AZ, PA, NJ",P2,19 Aug 2026 Document fabrication and photo manipulation,oldie.veriftools[.]ru,"Russian-hosted generator for passports, driver's licences, ID cards, and bank statements. Domain seized 2025-08",P2,19 Aug 2026 Document fabrication and photo manipulation,trustidcard[.]com,Broker producing identity documents to order; described in the manual as the expensive option,P2,19 Aug 2026 Document fabrication and photo manipulation,faceswapper[.]ai,Matching a document photograph to whoever will appear on camera,P2,19 Aug 2026 Document fabrication and photo manipulation,instant-portrait[.]com,Same role; also used to defeat reverse image search on persona photographs,P2,19 Aug 2026 Network infrastructure,cloudzy[.]com,"Hourly-billed US-region VPS, allowing instances to be created and destroyed at will. New York region specifically recommended",P2,19 Aug 2026 Network infrastructure,ishosting[.]com,"US and Canada VPS, preferred where a stable long-lived IP is needed",P2,19 Aug 2026 Network infrastructure,IPRoyal,Residential proxy layer. Ledger shows a $47 broker fee for passing identity verification and $20 to restore a suspended account,P2,19 Aug 2026 Network infrastructure,CCProxy,"Windows HTTP/SOCKS5 proxy run on a US VPS or supporter machine, presenting a distributed team as one American user",P2,19 Aug 2026 Network infrastructure,Astrill VPN,VPN provider. Explicitly rejected for job applications because ATS platforms flag it,"P1, P2",19 Aug 2026 Network infrastructure,Windscribe VPN,Secondary VPN provider,P2,19 Aug 2026 Network infrastructure,Hostinger,"Domain registration, hosting, and mailbox infrastructure",P2,19 Aug 2026 Network infrastructure,Vercel,Free subdomain hosting for bidding-service storefronts,P2,19 Aug 2026 Network infrastructure,bidpro-ochre[.]vercel[.]app,"Bidding-as-a-service storefront: batch pricing, named client list, live Google Sheets application logs. Not itself assessed as DPRK-operated",P2,19 Aug 2026 "Accounts, phone numbers, and verification",mailforspam[.]com,Disposable secondary address used during Gmail account creation,P2,19 Aug 2026 "Accounts, phone numbers, and verification",sms-man[.]com,SMS verification numbers at scale,P2,19 Aug 2026 "Accounts, phone numbers, and verification",sms-activate[.]org,SMS verification numbers at scale,P2,19 Aug 2026 "Accounts, phone numbers, and verification",2fa[.]live,"Browser-based TOTP generation, meaning MFA secrets are shared across a team rather than bound to a device",P2,19 Aug 2026 "Accounts, phone numbers, and verification",slynumber[.]com,"Current persona phone numbers, replacing Skype",P2,19 Aug 2026 "Accounts, phone numbers, and verification",hushed[.]com,"Current persona phone numbers, replacing Skype",P2,19 Aug 2026 "Accounts, phone numbers, and verification",Skype,"Historical persona numbers, assessed as drawing less suspicion than Google Voice. Now defunct",P2,19 Aug 2026 "Accounts, phone numbers, and verification",Google Voice,Explicitly rejected — recruiters recognise it as virtual immediately,P2,19 Aug 2026 "Accounts, phone numbers, and verification",CoinGate,Crypto-to-gift-card gateway used to fund phone and service accounts,P2,19 Aug 2026 "Accounts, phone numbers, and verification",Persona (inquiry.withpersona[.]com),Identity verification vendor targeted by the emulator and screen-capture bypass,P2,19 Aug 2026 "Accounts, phone numbers, and verification",LDPlayer,Android emulator used to redirect ID verification challenges away from a real camera,P2,19 Aug 2026 "Accounts, phone numbers, and verification",ShareX,Screen capture of verification QR codes for redirection into the emulator,P2,19 Aug 2026 "Accounts, phone numbers, and verification",VCAM,Virtual camera presented to verification flows in place of a physical camera,P2,19 Aug 2026 "Accounts, phone numbers, and verification",OBS,Same role as VCAM; named in the manual under a heading instructing use instead of a camera,P2,19 Aug 2026 "Accounts, phone numbers, and verification",AirDroid,Remote control of a physical Android handset from a computer,P2,19 Aug 2026 "Accounts, phone numbers, and verification",Cookie-Editor (Chrome extension),Importing LinkedIn session cookies so an authenticated session moves between operators without re-authenticating,P2,19 Aug 2026 "Storage, handoff, and coordination",protectedtext[.]com,Free password-protected plaintext notes used to distribute identity dossiers between operators,P2,19 Aug 2026 "Storage, handoff, and coordination",SendGB,Free file transfer with a retention window measured in days; used to hand off packaged operation archives,P2,19 Aug 2026 "Storage, handoff, and coordination",OneNote,Per-identity dossiers within the archive,P2,19 Aug 2026 "Storage, handoff, and coordination",Google Sheets,"Shared application logs with colour-coded status columns, between buyer and bidder","P1, P2",19 Aug 2026 "Storage, handoff, and coordination",WhatsApp,"Documented channel of communication, including a +234 (Nigeria) contact number",P2,19 Aug 2026 Persona construction and application,FlowCV,Resume builder. $70 annual line item in the expense ledger,P2,19 Aug 2026 Persona construction and application,ChatGPT,"Resume drafting, per-application tailoring, and interview answer generation","P1, P2",19 Aug 2026 Persona construction and application,Claude,Named alongside ChatGPT in the manual for the same purpose,P2,19 Aug 2026 Persona construction and application,ResumeKit,Per-application resume tailoring in the outsourced bidder workflow,P1,19 Aug 2026 Persona construction and application,LazyApply (Chrome extension),"Bulk application bot, purchased at roughly $170, claimed to support 750 applications per day across five profiles",P2,19 Aug 2026 Persona construction and application,Workday,"ATS submission target. IP-aware, which is why commercial VPNs are rejected","P1, P2",19 Aug 2026 Persona construction and application,Greenhouse,ATS submission target,"P1, P2",19 Aug 2026 Persona construction and application,"Indeed, Dice, Glassdoor, SimplyHired, ZipRecruiter, CareerBuilder",Named job boards for volume application,P2,19 Aug 2026 Interview and presence,Voicemeeter Banana,Virtual audio mixer routing one person's voice into a call another person appears to be attending,P2,19 Aug 2026 Interview and presence,Zoom,Interviews; also abused for remote control where enterprise policy permits it. Network artifact: saveUserDisclaimer,P2,19 Aug 2026 Interview and presence,Webex,Video conferencing used for remote control and screen sharing as a detection workaround,P2,19 Aug 2026 Interview and presence,Google Meet,Same role as Webex,P2,19 Aug 2026 Interview and presence,Excalidraw,Whiteboarding during technical interviews,P2,19 Aug 2026 Remote access to employer hardware,PiKVM,Hardware KVM on the employer-issued endpoint. Photographic evidence of continued use through 2026,P2,19 Aug 2026 Remote access to employer hardware,TinyPilot,Hardware KVM named in a diagram supplied to a prospective US facilitator,OL,19 Aug 2026 Remote access to employer hardware,EDID emulator,Fitted so the employer machine believes a monitor is attached and never sleeps,OL,19 Aug 2026 Remote access to employer hardware,RustDesk,Remote access software,P2,19 Aug 2026 Remote access to employer hardware,AnyDesk,Remote access software; also the mechanism offered to US-based recruits in place of bidding,"P1, P2, OL",19 Aug 2026 Remote access to employer hardware,TeamViewer,Remote access software,P2,19 Aug 2026 Remote access to employer hardware,Google Remote Desktop,Remote access software,P2,19 Aug 2026 Entity formation and contracting,Texas SOSDirect,Online filing portal for the Certificate of Formation (Form 205). $300 filing fee,P2,19 Aug 2026 Entity formation and contracting,IRS online EIN application,"Federal tax ID assigned immediately after formation, enabling a business bank account",P2,19 Aug 2026 Entity formation and contracting,Upwork,Freelance platform. Accounts created in a real American's identity because the platform tracks IP,"P2, OL",19 Aug 2026 Payments and cash-out,HuruPay,Stablecoin-backed virtual USD/EUR/GBP accounts marketed to non-US residents. Receives payroll and off-ramps near-instantly,P2,19 Aug 2026 Payments and cash-out,Payoneer,Withdrawal target for earnings held in a recruit's real name,"P2, OL",19 Aug 2026 Payments and cash-out,PayPal,Withdrawal target for earnings held in a recruit's real name,"P2, OL",19 Aug 2026 Payments and cash-out,Binance,Exchange and BSC on-ramp,"P1, P2",19 Aug 2026 Payments and cash-out,USDT (BEP20),Primary settlement asset for bidder payments and broker fees,"P1, P2",19 Aug 2026 Payments and cash-out,USDT (TRC20),Settlement asset for splitting and moving proceeds,P2,19 Aug 2026 Payments and cash-out,"USDC, ERC20, Polygon, Arbitrum",Additional rails visible in the ledger for splitting and moving proceeds,P2,19 Aug 2026 MITRE ATT&CK,T1589.001,Gather Victim Identity Information — Written victim selection criteria; LinkedIn name-and-role sourcing; background report acquisition,,19 Aug 2026 MITRE ATT&CK,T1585.001,Establish Accounts: Social Media — Purchased and laundered LinkedIn accounts; purchased Facebook accounts,,19 Aug 2026 MITRE ATT&CK,T1586,Compromise Accounts — Aged LinkedIn account takeover; session cookie portability,,19 Aug 2026 MITRE ATT&CK,T1588.007,Obtain Capabilities: Artificial Intelligence — ChatGPT for resumes and answers; AI face-swap tooling,,19 Aug 2026 MITRE ATT&CK,T1583.003,Acquire Infrastructure: Virtual Private Server — Cloudzy and ishosting US-region instances,,19 Aug 2026 MITRE ATT&CK,T1583.008,Acquire Infrastructure: Malvertising/Proxy — IPRoyal residential proxies; CCProxy chaining,,19 Aug 2026 MITRE ATT&CK,T1199,Trusted Relationship — Employment as the access vector; intermediary LLC contracting,,19 Aug 2026 MITRE ATT&CK,T1078,Valid Accounts — Employer-issued credentials retained in dossiers,,19 Aug 2026 MITRE ATT&CK,T1219,"Remote Access Software — RustDesk, AnyDesk, Google Remote Desktop",,19 Aug 2026 MITRE ATT&CK,T1200,Hardware Additions — PiKVM and TinyPilot on employer-issued endpoints,,19 Aug 2026 ``` > [!hm-footer] > **HAYDEN MCKENZIE** · Independent research. Primary sources. > > [[Research|Research]] · [LinkedIn ↗](https://www.linkedin.com/in/haymcken/) · [[Attachments/Hayden-McKenzie-CV.pdf|CV ↗]] · [Email ↗](mailto:[email protected])