AUTHORITIES in Jordan have detained a man linked to the ShinyHunters collective, Saif al-Din Khader, who is believed to be cooperating with the FBI. Reportedly, Khader is assisting investigators by providing access to devices and messages and helping to identify other members and map the group’s digital traces. The detention occurred around late September, with Reuters citing multiple sources, though the exact circumstances and Khader’s whereabouts remain unclear.
The FBI has not publicly confirmed an arrest abroad, but the agency notes ongoing investigations into a cyber incident allegedly tied to ShinyHunters and says it has previously detained several suspects in cooperation with partners. Separately, Dutch authorities detained a related suspect, kept in custody for a further 90 days.
Khader’s alleged connection to the alias Rey situates him within the broader Scattered LAPSUS$ Hunters ecosystem, a network that purportedly includes members from various extortion and hacking communities. Some media coverage has cited past statements suggesting Khader’s willingness to retire from hacking and cooperate with law enforcement, though ShinyHunters reportedly continued its operations into 2026.
The article also references ShinyHunters’ claims of breaching the FBI and data purportedly involving FBI employees, alongside attacks on PeopleSoft. Journalists say they reviewed a sample of stolen information, but there is no independent confirmation of the full extent of the breach, and links between the PeopleSoft exploit and the bureau incident remain unconfirmed.
Disruptions to ShinyHunters’ infrastructure followed Khader’s detention, though the group attributes outages to sabotage and unrelated events rather than direct law enforcement action.