ShinyHunters hacker detained in Jordan – now he’s helping FBI hunt down his own crew
"No safe haven", FBI Director Kash Patel warns cybercrime threat actors.
Image by Cybernews
Follow us
- Jordanian authorities detained Saif al-Din Khader, an alleged ShinyHunters member also known as Rey.
- Reuters sources say Khader is helping the FBI examine devices and trace other alleged gang members.
- ShinyHunters’ public channels and dark web site went silent amid signs of law enforcement disruption.
- The detention follows another recent arrest tied to ShinyHunters, while the FBI says more arrests may follow.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
A suspected member of the ShinyHunters gang has been detained in Jordan – he is now cooperating with the FBI to help track down others in the group.
Saif al-Din Khader, allegedly known as Rey in hacking circles, was brought into custody by Jordanian authorities on Tuesday, two people familiar with the matter told Reuters. They added that he’s currently helping the FBI and global law enforcement locate other gang members.
One source said Khader is helping investigators examine his devices and digital correspondence, adding that “his cooperation is critical to ongoing efforts to arrest these hackers”.
Khader’s identity had reportedly long been known to security researchers. He was previously identified as a key member of Scattered LAPSUS$ Hunters, which was formed in 2025 by members of ShinyHunters, Scattered Spider, and LAPSUS$.
The FBI didn’t comment on the arrest but said that the bureau "continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects — and we will spare no resource in bringing each of the responsible individuals to justice."
Signs of disruption emerged earlier this week as ShinyHunters went silent on its journalist-facing account before its dark web site disappeared on Wednesday.
The operators of a ShinyHunters-linked email address previously told Reuters that the site went offline due to sabotage from rivals and "disruption due to an unrelated incident."
More arrests on the table
On September 15th, Dutch police arrested “reformed” hacker Pepijn van der Stap as part of an investigation into ShinyHunters. At the time, FBI Director Kash Patel said that “more arrests are on the table.”
The FBI also warned the gang members to turn themselves in, while FBI Cyber Division Assistant Director Brett Leatherman said that “arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left”.
Nonetheless, authorities around the world have struggled to detain members of groups like ShinyHunters, Scattered Spider, and LAPSUS$ despite suspects being known to security researchers – in part because of their young age and victims’ reluctance to cooperate with law enforcement.
Khader’s detention comes shortly after ShinyHunters claimed to have breached the FBI, netting information on “almost all” FBI agents, employees, and job applicants who applied through the FBI jobs web portal.
The gang gave the FBI five days to remove what it called misinformation about how the group operates, telling Cybernews, “We got what we wanted and we have a business to run and operate as usual.”
