Account Hijacked. First time

[SnapOn]

EDIT

I can confirm, I downloaded a bad version of Runelite.

 

Nothing worse then logging into your osrs account and getting that error that its already logged in. Changed the password and logged in and my account was cleaned out.....

How does this happen? Password was not used on other accounts, My pc is clean... Took a dive into google about leaked databases from runescape?

 

Anyone have idea? Or has it happened to others?

Edited July 27, 2022 by SnapOn

[AnimalMother]

Which clients you have used in the past incl. steam? you have 2 factor auth for the osrs account?

[SnapOn]

3 minutes ago, AnimalMother said:

Which clients you have used in the past incl. steam? you have 2 factor auth for the osrs account?

Recently have been using runelite for the quest helper plugin. (Downloaded the client from the right source.)

I did not have the two factor auth enabled. (thats my bad i guess)

I made sure all accounts were un linked as of now also..

Just sucks...

[AnimalMother]

18 minutes ago, SnapOn said:

Recently have been using runelite for the quest helper plugin. (Downloaded the client from the right source.)

I did not have the two factor auth enabled. (thats my bad i guess)

I made sure all accounts were un linked as of now also..

Just sucks...

RL is completely safe with all it's plugins, IF you downloaded it from the correct source which you said you did.
Two-factor auth + bank pin is a must imo, now you learned it the hard way...

Maybe you used any other services in the past? Tried other bot clients? Downloaded anything remotely shady in connection to osrs/RS?

Would still maybe make sure ur computer is clean...

[Ricky Dactyl]

Had this happen once years ago when I used a OSRS service on my old main, still remember how gutted I was, was only 150M but when it was earned by hand and not through bossing it actually made me quit for a while, have you used any services in the past? Could be something like that.
Best of luck regardless in rebuilding

[D9BLADEE]

PW leak unrelated to RS 

[Khaleesi]

12 hours ago, SnapOn said:

Nothing worse then logging into your osrs account and getting that error that its already logged in. Changed the password and logged in and my account was cleaned out.....

How does this happen? Password was not used on other accounts, My pc is clean... Took a dive into google about leaked databases from runescape?

 

Anyone have idea? Or has it happened to others?

99% of the time it's leaked databases nowadays..
That's why you can't go without 2FA these days

[Czar]

Can confirm I was also hacked by leaked database on a previous botting site before osbot existed.. Hacker suicide botted on my account, got it banned, attempted to appeal the ban, got refused and now they won't answer any more appeals  

[SnapOn]

Can someone confirm the correct place to download Runelite from? I think i may have gotten it from a fake website.

 

I can confirm, I downloaded a bad version of Runelite.

Edited July 27, 2022 by SnapOn
Edit

[MrLights]

Dam man that really sucks, always double check any client you download. OG runelite will always tell you if you add a plugin which connects to any other website or if it shares data.

[iz0n]

tbh.. i have good knowledge in this field.

feel free to pm me anytime.

to do :

1# change all your passwords from a clean device/pc. 

its obvious why...its highly likely to have a keylogger, pwd grabber installed into ur pc by now. and you dont want to get hijacked again.

2# disbale all 2nd auth, and re-enable it again.

since they have access to ur pc, they can copy ur current cash files, and use them again to bypass 2nd auth, on any other pc.

3# if you cant locate the malware, i suggest you do full re-installation of ur windows. (not a re-pair mode)

since the malware can be hidden in many many places, even in file-less form, it will recover itself if the coder is smart enough.

common places to check in (startup/task scheduler/drivers...basically its a mess)

 

ps, id be glad if you give me a sample

 

 

edit:

it doesn't have to be a bad version, it could just be a bad plug-in. which could trigger the malware code by time or event...etc.

Edited July 28, 2022 by iz0n