// AI threat desk · 5 Oct 2026
Home/AI-ATK · AI-Powered Attacks
AI-Powered AttacksMediumSHINYCVSS not assigned

Jordanian authorities reportedly detained suspected ShinyHunters member Rey

Jordanian authorities reportedly detained suspected ShinyHunters member Saif al-Din Khader, known as Rey, on Sep 29, 2026. Reuters disclosed the account.

· 2 min read
AI-generated image of officials outside an interview room with a blurred laptop and documents.
AI-generated image, not a photo of the event.
Key takeaways
  • Reuters said Khader was reportedly taken into custody in Jordan on Sep 29, 2026.
  • Reuters said Khader is reportedly cooperating with the FBI and law enforcement.
  • Hackread reported that two sources told Reuters that Khader is walking investigators through his electronic devices and communications to help identify other members.

Jordanian authorities reportedly detained Saif al-Din Khader, a suspected ShinyHunters member known online as Rey, on Sep 29, 2026, Reuters said. Khader is reportedly cooperating with the FBI and other law enforcement agencies.

Hackread reported that two sources told Reuters that Khader is walking investigators through his electronic devices and communications to help identify other members. A source also told Reuters his cooperation is critical to ongoing efforts to arrest the hackers.

HKCERT published its report on Oct 3, 2026. Sekoia describes ShinyHunters as a financially motivated data theft and extortion brand that has persisted since 2020 across changing membership.

On this page

Sources said Khader is helping trace other ShinyHunters members

Reuters said sources told it that Khader is cooperating with the FBI and law enforcement. One source said, “His cooperation is critical to ongoing efforts to arrest these hackers.”

Hackread reported that two sources said Khader was helping the FBI and other law enforcement agencies identify and locate hackers connected to the group. Cybernews similarly reported that the detained hacker was helping the FBI trace other gang members.

Khader was linked to Scattered Lapsus$ Hunters, SecurityWeek reported

SecurityWeek reported that Khader is a teenage cybercriminal from Amman and a known member of Scattered Lapsus$ Hunters. It said the detention followed the group’s hack and defacement of FBIJobs.gov and its claim of taking 2-3 terabytes of data.

The FBI said it continues to “aggressively investigate” the recent cyber incident allegedly involving ShinyHunters and will spare no resource in bringing responsible individuals to justice.

A second suspected member was arrested in Amsterdam on Sep 15

Dutch National Police and the FBI previously reported that a second suspected member, a 24-year-old from Amsterdam, was arrested on Sep 15 on suspicion of being a ShinyHunters member.

Sekoia said ShinyHunters has persisted since 2020 while its membership changes. Malwarebytes described the group as a financially motivated cybercrime and extortion group active since 2019.

Hackread reported that the FBI declined to confirm a specific arrest abroad but said it is continuing to investigate the alleged ShinyHunters incident and had worked with international partners to arrest multiple suspects.

Hackread reported that the circumstances of Khader’s detention and his current location have not been disclosed. SecurityWeek also reported that it is unclear where he is detained.

FAQ

Who is Saif al-Din Khader, also known as Rey?

Reuters identified Khader as a suspected ShinyHunters member who uses the alias Rey. SecurityWeek reported that he is a teenage cybercriminal from Amman and a known member of Scattered Lapsus$ Hunters.

Is Rey helping the FBI identify other hackers?

Sources told Reuters that Khader is cooperating with the FBI and law enforcement and is walking investigators through his electronic devices and communications to help identify other members.

Where is Saif al-Din Khader being held?

Hackread reported that Khader’s current location has not been disclosed. SecurityWeek reported that it is unclear where he is detained.

What is ShinyHunters?

Sekoia describes ShinyHunters as a financially motivated data theft and extortion brand that has persisted since 2020 across changing membership. Malwarebytes described it as a financially motivated cybercrime and extortion group active since 2019.

Sources

  1. ShinyHunters Suspect Rey Reportedly Detained in Jordan, Helping FBI Identify Group Members, HKCERTPrimary
  2. Gotta Breach 'Em All! The Journey Of ShinyHunters, SekoiaPrimary
  3. ShinyHunters hacks rival extortion gang and takes over its dark web site, MalwarebytesPrimary
  4. Alleged ShinyHunters Leader Arrested in Jordan, SecurityWeek
  5. ShinyHunters Suspect “Rey” Detained in Jordan, Reportedly Helping FBI, Hackread
  6. ShinyHunters hacker detained in Jordan – now he’s helping FBI hunt down his own crew, Cybernews
  7. ShinyHunters hacker reportedly detained in Jordan, aiding FBI, BleepingComputer
  8. Suspected ShinyHunters hacker detained in Jordan, cooperating with FBI, sources say, CBS News
  9. ShinyHunters, Wikipedia
How we checked this story
ClaimSourceStatus
A suspected ShinyHunters member using the alias Rey was allegedly detained by authorities in Jordan, Reuters reported.Reuters, via HKCERTAttributed
Reuters said saif al-Din Khader was reportedly taken into custody on 29 September 2026 and is cooperating with the FBI and law enforcement.Reuters, via HKCERTAttributed
SecurityWeek reported that Khader is a teenage cybercriminal from Amman and a known member of Scattered Lapsus$ Hunters.SecurityWeekAttributed
SecurityWeek reported that Khader’s detention location is unclear.SecurityWeekAttributed
SecurityWeek reported that the arrest followed the group’s hack and defacement of the FBI jobs site and its claim of stealing 2–3 terabytes of data.SecurityWeekAttributed
Hackread reported that two sources said Jordanian authorities took Khader into custody Tuesday.HackreadAttributed
Hackread reported that the circumstances of Khader’s detention and his current location have not been disclosed.HackreadAttributed
Hackread reported that the FBI declined to confirm a specific arrest abroad but said it was continuing to investigate and had worked with international partners to arrest multiple suspects.HackreadAttributed
Cybernews reported that the detained hacker was helping the FBI trace other gang members.CybernewsAttributed
BleepingComputer reported that a suspected ShinyHunters member known as Rey was detained in Jordan and cooperating with the FBI.BleepingComputerAttributed
CBS News reported that two U.S. officials and another source said Jordanian authorities detained Saif al-Din Khader.U.S. officials, via CBS NewsAttributed
The FBI said it was aggressively investigating the alleged ShinyHunters cyber incident and had worked with partners to arrest multiple subjects.FBI, via CBS NewsAttributed
Sekoia described ShinyHunters as a financially motivated data theft and extortion brand that has persisted since 2020 across changing membership.SekoiaConfirmed
Malwarebytes reported that ShinyHunters breached the leak site of the Clop ransomware gang.MalwarebytesAttributed
Malwarebytes reported that ShinyHunters is a financially motivated cybercrime and extortion group active since 2019.MalwarebytesConfirmed
Wikipedia describes ShinyHunters as a black-hat criminal hacker and extortion group active since 2019.WikipediaConfirmed
HKCERT published its report on Oct 3, 2026.HKCERTConfirmed
sekoia.com published its report on Oct 1, 2026.sekoia.comConfirmed
malwarebytes.com published its report on Sep 21, 2026.malwarebytes.comConfirmed

Could not verify

  • Whether Khader faces charges is not established
  • Whether Jordan intends to extradite Khader is not established
  • How many other alleged ShinyHunters members remain involved is not established
  • Whether Khader’s reported cooperation will lead to further arrests is not established
  • Whether the reported detention is formally confirmed by Jordanian authorities is not established
See all in AI-Powered Attacks →
Explore with AI
ChatGPT
Claude
Perplexity
Grok