Counterintelligence — 2026-10-08

ShinyHunters Leader Detained in Jordan Cooperating With FBI as Group Was Extorting Former Boeing Subsidiary

BLUFKhader's cooperation and the FBI's acknowledgment of multiple arrests make it likely that at least one more ShinyHunters member will be publicly charged by year-end.

Reuters reported on October 3, citing three unnamed sources, that Saif al-Din Khader, alias "Rey," was detained by Jordanian authorities and is helping the FBI and global law enforcement locate other ShinyHunters members 1. Reuters' sources differ with The Record's account of a September 28 arrest: two Reuters sources said custody began Tuesday 12. The FBI declined to comment on the specific arrest but said it has already worked with partners to arrest multiple subjects 12. KrebsOnSecurity, citing two sources, reported on October 7 that ShinyHunters was extorting Jeppesen ForeFlight, a unit Boeing sold in November 2025, when Khader was detained 3. Boeing acknowledged the claims, and Jeppesen ForeFlight said its operations and products were not affected 3.

Analysis
US or allied authorities will likely publicly announce the arrest or charging of at least one more alleged ShinyHunters member besides Khader by December 31. Confidence is moderate, since the case rests on one primary account of his cooperation plus public FBI language about multiple arrests, and nothing shows what his devices have yielded. Reuters is the sole primary source, and the other outlets extend it with anonymous sourcing. Reuters' Tuesday custody date contradicts The Record's September 28 date, and the Jeppesen ForeFlight extortion, with data carrying operational safety implications, raises the case's urgency inside the FBI. Khader may instead have been a brand-reviver with little knowledge of the freelancers supplying credentials, leaving affiliates unnamed into next year. Another arrest would let defenders treat the credential network as disrupted and shift to remediation. Without one, PeopleSoft users and aviation firms should assume active extortion and keep patching.

3 sources

Exclusive-ShinyHunters hacker in FBI data theft detained in Jordan, cooperating with bureau, sources say - Reuters (via The Star)
Alleged ShinyHunters member detained in Jordan, cooperating with FBI - The Record
ShinyHunters Extorted Boeing Spin-off Prior to Arrests - Krebs on Security