Storm Client Security Vulnerability Exposed: Full Technical Breakdown
A complete technical breakdown of the credential-stealing vulnerability found in Storm Client's Allure plugins, including how the exfiltration works and who is affected.
After decompiling the Allure plugin JAR files distributed through Storm Client, we found deliberate, well-hidden code whose only purpose is to steal your RuneScape account. This is not a bug or an accidental data leak — it is intentional malware shipped inside a paid product. Here is exactly what it does.
What the vulnerability actually is
Calling it a "vulnerability" is generous. A vulnerability is usually an unintended flaw. What Storm Client ships is intentional data theft: the Allure plugins hook into RuneLite's login flow, read your credentials and session token directly from memory, and transmit them to a server controlled by the developer.
How the exfiltration works
- On login, the plugin captures your username and password before they are cleared from memory.
- It reads the Jagex session token, which allows account access even without your password.
- It collects your linked Discord ID, IP address, and hardware identifiers.
- All of this is serialized and POSTed to a remote endpoint on a repeating timer.
Because the session token is stolen, changing your password alone is not enough — an attacker with a live token can stay logged in. That is why our guidance is to change your password and invalidate active sessions from the Jagex website.
Who is affected
Anyone who has run any Allure plugin from storm-client.net, on any subscription tier including the free tier, should assume their credentials are compromised. The malicious code is present in the free plugins too — the paid tiers simply unlock more of them.
What to do right now
- Change your RuneScape password from the official Jagex website, not the game client.
- Enable the Jagex Authenticator and end all active sessions.
- Check your bank, trade history, and Grand Exchange for unauthorized activity.
- Uninstall Storm Client and run a full antivirus scan.
- Switch to official RuneLite.
Why open source matters
RuneLite is open source and community-audited. When code is public, credential theft like this cannot hide. Closed, obfuscated third-party clients like Storm Client ask you to trust a stranger with your account — and in this case that trust was abused.