ShinyHunters Suspect 'Rey' Detained in Jordan, FBI Cooperating

Suspected ShinyHunters member Saif al-Din Khader, 'Rey,' detained in Jordan on Sept. 29, 2026, is cooperating with the FBI to identify fellow hackers.

Saif al-Din Khader, the suspected ShinyHunters member known online as 'Rey' or 'ReyXBF,' was taken into custody by Jordanian authorities on September 29, 2026, according to Reuters, which cited three people familiar with the matter. Two of those sources said he is now cooperating with the FBI and global law enforcement to locate other hackers in the group. Reuters reported that Khader is walking investigators through his electronic devices and digital correspondence, and a source told the agency, 'His cooperation is critical to ongoing efforts to arrest these hackers.' The FBI declined to comment on any specific arrest abroad but said it 'continues to aggressively investigate' the incident and will 'spare no resource in bringing each of the responsible individuals to justice.'

What makes this development surprising is that Khader's cooperation appears to have flipped a member from inside the group into an informant. Brian Krebs had previously reported, in November 2025, that Khader was one of three administrators of Scattered LAPSUS$ Hunters — an umbrella group assessed to combine Scattered Spider, LAPSUS$, and ShinyHunters. Krebs also noted that Khader had been an administrator of the data leak site for the Hellcat ransomware group and later took over the most recent incarnation of BreachForums in 2024. Khader told Krebs he had been cooperating with law enforcement since at least June 2025, yet ShinyHunters continued operations into 2026, claiming intrusions at Rockstar Games and education platform Canvas. The detention now shows law enforcement moving decisively inside the group's core.

ShinyHunters claimed on September 22 that it had hacked the FBI in retaliation for an agency advisory accusing the group of making 'exaggerated claims of access' to extort victims. A Reuters analysis of a sample of the shared data revealed extensive personally identifiable information on FBI employees, sensitive job role information, and psychiatric and medical records. FBI assistant director Brett Leatherman said the group and its co-conspirators have allegedly breached more than 140 organizations and taken at least $70 million in extortion payments, often targeting third-party vendors on cloud platforms to steal and extort with threats of publication. The FBI theft drew comparisons to the 2015 Office of Personnel Management intrusion.

There had been hints for days that the group was in disarray. The operators of a ShinyHunters-linked email account told Reuters the site went offline due to sabotage from rivals and 'disruption due to an unrelated incident.' Their tone also shifted sharply: after a defiant ultimatum demanding the FBI withdraw its advisory within a week, the most recent email struck a conciliatory note, saying 'we want no further escalation' — which Reuters noted could be read as 'ShinyHunters backing down completely.'

Khader's detention follows the arrest of another alleged ShinyHunters member, a 24-year-old Amsterdam man detained in the Netherlands last week, whom independent reports identified as Pepijn van der Stap, an offensive security lead at Dutch company Neo Security. A ShinyHunters spokesperson denied any connection to van der Stap, whom Leatherman described as an alleged leader of the group. FBI Director Kash Patel posted on X, 'FBI teams are working new leads RIGHT NOW. More arrests are on the table.' Leatherman urged remaining members to come forward, saying, 'Arrests have a way of changing who is willing to talk, and seized infrastructure has a way of showing us who's left.'

The circumstances of Khader's detention and his current whereabouts could not be determined by Reuters, and attempts to reach him and his family were unsuccessful. Researchers from Sekoia and Beazley Security, cited by The Hacker News, traced ShinyHunters' lineage to TheDarkOverlord and GnosticPlayers, with the brand emerging publicly around April or May 2020. They wrote that 'ShinyHunters is less a group than a brand and business model that has outlived its founders,' sustained by a modular division of labor rather than any single leader. With two members detained and the group's infrastructure and messaging channels collapsing, investigators appear positioned to pursue the remaining participants, while Khader's cooperation may help contain or at least explain the damage from the FBI breach.