Overview
- Jordanian authorities detained a suspected ShinyHunters member this week who multiple sources say is now cooperating with the FBI to help identify other group members.
- The detained person is reported to be Saif al‑Din Khader, known online as “Rey,” and sources say he is walking investigators through his electronic devices and digital communications.
- Dutch police previously arrested a 24‑year‑old Amsterdam man in mid‑September identified by reporters as Pepijn van der Stap and authorities say that arrest remains part of the coordinated international probe.
- Security firms including Google Threat Intelligence Group and Mandiant have documented mass exploitation of an Oracle PeopleSoft vulnerability (CVE‑2026‑35273), which is a plausible initial access vector investigators are actively examining.
- Samples Reuters reviewed appear to contain extensive personally identifiable, medical and job‑related records for FBI personnel, raising safety and counterintelligence concerns while ShinyHunters’ public leak site showed disruption then resurfaced.