A threat actor has defaced the shinyhunte.rs clearnet website, a domain linked to the notorious data extortion group ShinyHunters. The message displayed on the seized homepage directly calls out an individual referred to as “James from the Scattered,” urging them to “hide from now on and disband scattered.” The post concludes by asserting that the perpetrators of the defacement are the “real ShinyHunters,” implying that the previous operators were imposters. This public dispute points to a schism within one of the most aggressive data theft and extortion rings active today.












