ShinyHunters Informant Caught, 543K Passwords Left in the Open
Sunday, October 4, 2026 · 5-minute read
A hacker known online as "Rey" — real name Saif al-Din Khader — was arrested in Jordan on September 29 and is now cooperating with the FBI. Investigators say his cooperation is helping them identify and locate other members of ShinyHunters, one of the most prolific data-theft gangs operating today. Rey was previously identified as an administrator of a combined group merging three notorious hacker collectives: Scattered Spider, LAPSUS$, and ShinyHunters.
↗ The Hacker NewsDutch authorities arrested Pepijn van der Stap — a convicted cybercriminal who had previously served prison time for data theft and extortion — on or around September 16. Van der Stap had been working as an offensive security professional after his release in December 2025, and had spoken to journalist Brian Krebs just days before going silent. In a chilling twist, ShinyHunters responded to the arrest by escalating attacks: stealing data from the FBI and extorting the Russian ransomware group Cl0p.
↗ Krebs on SecurityBritain's domestic spy agency MI5 says more than 100 UK-linked academics unknowingly contributed to research funded by China's Ministry of State Security. The money flowed through a front organization called the China General Technology Research Institute, which commissioned work on AI, cybersecurity, and covert communications. MI5 stressed that some researchers may not have realized they were helping a foreign intelligence service.
↗ The Hacker NewsA Chinese cyber espionage group called TA419 is running fake email campaigns aimed at AI researchers at US think tanks, universities, and law firms. The attackers pose as well-known economists, AI policymakers, and even an Anthropic employee. One email used the subject line "Request for Feedback on Military Integration of Claude" to trick a policy expert into clicking a malicious link. The goal is a technique called Adversary-in-the-Middle phishing, which lets attackers steal login credentials even if you have two-factor authentication enabled. China appears to want inside knowledge of how the US is shaping AI regulation and policy — intelligence that could give Beijing a strategic edge in the global AI race.
A China-linked hacking group called Warlock (also tracked as Storm-2603 and Longlegs) is breaking into critical infrastructure by exploiting weaknesses in Microsoft SharePoint — the widely used file-sharing software found in thousands of organizations. In the past two months alone, Warlock has hit a water utility, a telecommunications provider, a regional government body, and a university, all in Portuguese- and Spanish-speaking countries across Europe, Africa, and Latin America. Once inside, the attackers disable security tools and deploy ransomware, leaving victims unable to access their own systems.
Fortinet's FortiMail product — used by businesses to filter and secure email — has a serious flaw that lets attackers run their own commands on the system without needing a password. This is already being actively used in real-world attacks, meaning criminals are exploiting it right now, not just in theory. If your organization uses FortiMail and hasn't patched yet, you are at immediate risk.
Status: Patch available — apply immediately. Fortinet has issued an emergency update.
Cisco has warned customers of a brand-new zero-day vulnerability in its SD-WAN software, which companies use to manage their network connections across multiple offices and cloud services. Attackers are already using this flaw in active attacks. Cisco SD-WAN is common in mid-to-large enterprises, so the potential blast radius is significant.
Status: Cisco has issued a warning. Check Cisco's security portal for available patches or mitigations and apply immediately.
GitLab — the popular platform developers use to store and collaborate on code — has a critical flaw in its AI Gateway service. The bug allows an attacker to run any command they want on a vulnerable GitLab instance, which could mean wiping code repositories, stealing credentials, or planting malicious code in software projects. Organizations that develop software and self-host GitLab are most at risk.
Status: Patch available — GitLab is urging customers to update immediately.
Push Security released fresh analysis this week showing just how fast browser-based attacks are evolving. Nine out of ten phishing kits are now built with the help of AI, making it easier than ever for low-skilled criminals to launch convincing scams. The report also found that four out of five ClickFix attacks — a technique that tricks people into running malicious commands on their own computers — start from regular search engine results, not suspicious emails. Even more striking: phishing domains now stay active for just two days on average before being swapped for fresh ones, making them almost impossible to block in time. The findings highlight that your web browser has quietly become one of the most dangerous places attackers target.
More than 543,000 valid, working credentials were discovered exposed in public GitHub repositories this week. That means over half a million real usernames and passwords — for live, active accounts — were sitting in the open where anyone on the internet could find and use them.
Here's how it happens. Developers often store secret keys, passwords, and API tokens directly inside their code files while building software — it's a shortcut that speeds up testing. The problem is that when they push that code to a public GitHub repository, every secret in those files goes public too. It's a bit like writing your house alarm code on the back of a postcard and mailing it to strangers. Many developers forget the secrets are there, or assume nobody will go looking. They're wrong. Automated bots scan GitHub around the clock specifically hunting for exactly this kind of exposed data.
For regular people, the risk is real even if you've never touched a line of code. The exposed credentials include access tokens and passwords for services that power apps and websites millions of people use every day. If a developer accidentally exposed the admin password to a service you use, attackers could access your data without ever targeting you personally. You'd never know a breach happened until your information showed up for sale online.
Watch for breach notification emails from services you use, and treat any unexpected password-reset requests as a red flag. If you reuse passwords across sites — now is the time to stop. A password manager makes it easy to give every account a unique password, so one exposed credential can't unlock everything else you own.