Resecurity Caught ShinyHunters in Honeypot

Resecurity has claimed that ShinyHunters, also known as Scattered Lapsus$ Hunters (SLH), were caught using decoy accounts in a honeypot operation, after the group targeted airlines, telecoms and law enforcement in September 2025. The incident saw the threat actors engage with a decoy environment created by Resecurity, who used publicly available datasets from the Dark Web, such as HITB, alongside outputs generated by OpenAI to shape realistic deception data.

In Telegram, the group boasted that they had “compromised” Resecurity, though the honeypot was designed to contain no sensitive information. The report notes that previous targets of similar deception campaigns included Mandiant (now part of Google) and CrowdStrike. Resecurity published an account detailing logged IP addresses and residential proxies used by the actors, and highlighted several OPSEC mistakes that exposed their sources of connection.

The piece, published on Security Affairs on 4 January 2026, situates the episode as a notable example of cyber deception and honeypot effectiveness. According to Resecurity.