Cyber Security News reports that a Jordanian youth known as “Rey” and “Hikki-Chan” online has been detained in Jordan as a suspected member of ShinyHunters. Reuters broke the story, reporting that sources told them Saif al-Din Khader was cooperating with the FBI to help them identify other hackers linked to the group.
Two sources said Jordanian authorities took Khader into custody on Tuesday, September 29. They also said he was helping the FBI and law enforcement agencies worldwide locate other group members. Reuters could not establish why he was detained or where he was being held, and attempts to contact him and his family were unsuccessful.
The FBI declined to confirm any specific arrest or overseas operation. However, it said it “continues to aggressively investigate the recent cyber incident allegedly involving ShinyHunters,” adding that it had already worked with partners to arrest multiple subjects. The bureau pledged to pursue everyone responsible.
Read more at Cyber Security News.
Khader was reportedly a leader or administrator of a Telegram channel for a combined group known as “ScatteredLapsusShinyHunters.” He also posted on forums, originally as part of “Hellcats.” Journalist Brian Krebs reported on Khader in November 2025.
Following the attack on the FBI, Khader posted something on X.com that seemed to boast about the FBI’s attacks on the Cl0p ransom group and the FBI. In the corner of the post, an “Umbreon” cartoon appeared, leading some to believe that Khader might be trying to frame a Dutch national previously known as “Umbreon.” Unbeknownst to Khader or others, though, the Dutch national had been arrested on September 15 and could not have been responsible for the Cl0p defacement and hack or the FBI defacement and hack.
The post has since been removed.
