Detained ShinyHunters hacker reportedly helping FBI track down fellow members
Jordan detained alleged ShinyHunters member Rey, who is reportedly cooperating with the FBI against the group.
Jordanian authorities detained Saif al-Din Khader, known as Rey, a suspected ShinyHunters member who is reportedly walking FBI investigators through his devices and correspondence. Reuters could not confirm the circumstances or where he is held. The FBI said it continues to investigate ShinyHunters after the group claimed an Oracle PeopleSoft zero-day breach of FBI job-applicant portals that exposed personnel and medical files. Dutch police last week arrested a 24-year-old Amsterdam man whom FBI Director Kash Patel called an alleged ShinyHunters leader.
- Jordan detained Saif al-Din Khader, alias Rey, a suspected ShinyHunters member.
- He is reportedly guiding the FBI through his devices and messages.
- Dutch police arrested a 24-year-old alleged ShinyHunters leader in Amsterdam.
- The group claimed an Oracle PeopleSoft zero-day breach of FBI hiring portals.
- ShinyHunters is known for vishing employees while posing as IT support.
Full article678 words · extracted from helpnetsecurity.com · click to collapse
A suspected ShinyHunters member known as Rey has been detained in Jordan and is reportedly helping the FBI track down the rest of the group.
Reuters reports that Jordanian authorities detained Saif al-Din Khader, alias Rey, last week, with two of its three sources placing the arrest on Tuesday.
One source told the publication that Khader is walking investigators through his electronic devices and digital correspondence. “His cooperation is critical to ongoing efforts to arrest these hackers,” the source told the publication.
Reuters could not determine the circumstances of the detention or where Khader is being held. Attempts to reach him and his family over the past week and a half were unsuccessful.
“Rey got picked up finally,” security researcher Kevin Beaumont wrote on Mastodon, adding that Rey “was one of the kids who got into JLR,” a detail not included in the Reuters article.
The FBI declined to comment on specific arrests, but noted it “continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters, having already worked with partners to arrest multiple subjects.” The bureau also vowed it “will spare no resource in bringing each of the responsible individuals to justice.”
The FBI hack
The arrest escalates the fight between the FBI and the notorious hacking group following its attack on the bureau.
Last month, ShinyHunters claimed it breached the FBI’s job applicant portals through an Oracle PeopleSoft zero-day and stole personnel files of current, former and prospective employees, including medical information. The group called the attack retaliation for an FBI advisory urging victims not to pay ransom, and threatened to leak the data unless the bureau retracted its “false allegations.”
In a statement sent to reporters last week, ShinyHunters promised it would not publish the stolen FBI data and claimed it had never intended to. The group described the hack as “a marketing campaign to protect our business and actively combat disinformation,” insisting its message “may have been worded like a threat” but was not one.
BBC cyber correspondent Joe Tidy reported that the hackers denied getting cold feet. In his view, “the data has been stolen and the FBI are unlikely to call off the hounds on a pinky promise that the data won’t be sold/shared.”
Last week, Dutch police confirmed the arrest of a 24-year-old man from Amsterdam as part of their investigation into ShinyHunters.
After the arrest, FBI Director Kash Patel wrote on X that the FBI, working with Dutch police, helped put “an alleged leader of ShinyHunters” behind bars. “FBI teams are working new leads RIGHT NOW. More arrests are on the table,” he added. “If you attack Americans from behind a keyboard anywhere in the world, we will find you.”
Who is Rey?
Khader’s identity and his alleged link to ShinyHunters have been known to security researchers for some time. Last year, independent journalist Brian Krebs identified Khader as a key member of Scattered Lapsus$ Hunters, an umbrella group of hackers that included ShinyHunters.
According to Krebs, Khader had previously run the data leak site of the Hellcat ransomware group and administered BreachForums.
Krebs spoke to the teenager over Signal, and Khader told him he had been talking to law enforcement since at least June 2025. “I don’t really care I just want to move on from all this stuff even if its going to be prison time,” he said.
A busy year for ShinyHunters
ShinyHunters is known for vishing, a social engineering tactic in which attackers call employees while posing as IT support staff and trick them into handing over sensitive information.
The group has stepped up its activity in recent months, with breaches at ADT, the European Commission, Aura and Rockstar Games attributed to it.
In May, Instructure, the company behind the Canvas learning platform, said it reached an agreement with ShinyHunters to keep stolen data from being leaked. The group claimed it took 3.65 TB of data tied to 275 million records from 8,809 educational institutions.
Given the FBI’s latest statements and its need to show strength, more arrests can be expected soon.