A suspected member of the ShinyHunters hacking group has been detained in Jordan and is reportedly cooperating with the FBI as investigators intensify their efforts to identify other people connected to the cybercrime operation.
The suspect has been identified by sources as Saif al-Din Khader, who is allegedly known online as “Rey.” Jordanian authorities detained him in late September, and officials in the country have since confirmed that a suspected member of the hacking group is under investigation.
Sources familiar with the case say Khader is now assisting the FBI and other law enforcement agencies in locating additional hackers associated with ShinyHunters. He has reportedly provided investigators with electronic devices and digital communications that could help identify other participants.
The exact circumstances surrounding his detention remain unclear. Authorities have not publicly explained what charges, if any, Khader currently faces, where he is being held or what agreements may have been made regarding his reported cooperation.
The FBI has also avoided discussing the individual case. The bureau said it continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters and has already worked with international partners to arrest multiple suspects.
Khader has previously been linked to several prominent parts of the cybercrime ecosystem. Under the Rey alias, he has been identified by security researchers and journalists as a figure associated with ShinyHunters and the wider Scattered LAPSUS$ Hunters community.
He has also been linked to the administration of cybercrime platforms, including an incarnation of BreachForums and the leak site operated by the Hellcat ransomware group. These connections illustrate the increasingly blurred boundaries between hacking groups, data leak sites and online communities used to trade stolen information.
His detention comes during an escalating international investigation into ShinyHunters. The group recently attracted particular attention after claiming responsibility for compromising the FBI’s recruitment website and stealing a large collection of information associated with bureau employees and job applicants.
ShinyHunters claimed to have obtained between two and three terabytes of data. The full size of that collection has not been independently confirmed, but material examined during reporting included highly sensitive personal information connected to FBI personnel.
The FBI acknowledged unauthorized activity involving FBIJobs.gov and launched an investigation. The seriousness of the incident became clearer when an internal bureau memo reportedly instructed personnel to operate under the assumption that employee information had been exposed.
Khader’s detention follows another major development in the investigation. Dutch police arrested a 24-year-old Amsterdam man on September 15 on suspicion of involvement with ShinyHunters.
The FBI described the suspect as one of the group’s alleged leaders and said ShinyHunters and its co-conspirators had breached more than 140 organizations since last year and collected at least $70 million in extortion payments. ShinyHunters has rejected the FBI’s characterization of the Dutch suspect and denied that he belongs to its current operation.
The group has continued to present itself as active despite the arrests. Its dark-web website temporarily disappeared before resurfacing at a new address, with ShinyHunters saying it had moved the infrastructure because of technical problems and DDoS attacks rather than a law enforcement seizure.
Khader’s reported cooperation could prove more significant than the loss of a website. Access to a suspected member’s devices, communications and knowledge of other participants could give investigators information about identities and relationships that are normally hidden behind aliases and anonymous online infrastructure.