Is storm-client.net Legit? An Honest Review of Storm Client
A straight answer on whether storm-client.net is legit: it sells RuneLite plugins that were found, on decompilation, to contain account-stealing malware. Here's the evidence and the verdict.
If you are searching whether storm-client.net is legit before paying for a subscription, this is the short version: the site is real and it will take your money, but the "premium" Allure plugins it sells were found to contain malware that steals your RuneScape account. We do not recommend it.
What storm-client.net claims to be
The site markets itself as a premium RuneLite plugin platform with a shop, subscription tiers (around €5/week to €15/month), and a Discord community. On the surface it looks like a normal paid tool.
What we actually found
We decompiled the Allure plugin JAR files distributed through Storm Client. The code contains deliberate routines that:
- Capture your RuneScape username and password at login.
- Read your Jagex session token (which grants account access without the password).
- Collect your Discord ID, IP address, and hardware identifiers.
- Send all of it to a remote server on a repeating timer.
Other red flags
- The plugins are closed-source and obfuscated — you cannot audit what they do.
- The developer was reportedly banned from major OSRS marketplaces such as Sythe.
- Storm Client is not a Jagex-approved client, so using it is bannable regardless of the malware.
Verdict
Not legit in any way that protects you. Use official, free, open-source RuneLite instead. If you have already paid for or installed Storm Client, change your RuneScape password from the Jagex website, enable the authenticator, and end all active sessions immediately.