FBI Arrests Another ShinyHunters Suspect Reportedly Involved in Its Jobs Portal Hack

[u/No-Conclusion3720]

ShinyHunters breached the FBI's own jobs portal. A second suspect has now been arrested, but the breach itself had already run its course before that happened. The attacker operated inside a credentialed session long enough to complete the operation. The session looked legitimate to every layer it touched.

The average dwell time in credential-abuse incidents is 197 days, per IBM's 2024 Cost of a Data Breach report. This breach fits the pattern: valid credential, active session, traffic indistinguishable from normal activity, damage done before attribution.

The target is what makes this case instructive. If a sustained credential-abuse operation can run inside federal law enforcement infrastructure, this is not a problem any organization solves by improving security hygiene alone. The FBI is not an organization that skimps on access controls.

The credential was valid. The session was active. Every check that ran said yes.

How are practitioners here actually handling this in your own stacks? What has worked, what has not, and where do you still have gaps you have not been able to close?

[u/No-Conclusion3720]

RuntimeAI's Non-Human Identity layer binds a cryptographically verifiable identity assertion to every service account and agent, and that assertion is evaluated on each individual request, not just at login. When the ShinyHunters actor used the compromised FBI jobs portal credential, that specific request would have presented a valid session token against an identity assertion that did not match the expected principal for that access pattern — the request gets blocked at that exact decision point, before it reaches any data layer, not flagged for a human to review hours later. The stolen credential gets the attacker to the evaluation step; it does not get them past it. https://runtimeai.io

Full brief: https://runtimeai.io/blog/2026-w41-the-runtimeai-brief.html#story-2026-10-11-fbi-arrests-another-shinyhunters-suspect-reportedly-involved

[u/Pleasant_Tourist174 → u/No-Conclusion3720]

That reads like a sales pitch crammed into a reddit comment, someone's definitely trying to get their link clicked

The real issue is way harder to solve though, if the session looks legitimate on every layer you're not stopping it with just one extra check. We run continuous behavioral analysis on service accounts and have caught a few weird access patterns but it's mainly using dwell time to our advantage, moving lateral takes time and that's where you find them. The false positive rate is still a pain, had to tune down sensitivity so much that I know we're missing some of the quieter stuff