Hacked even authenticator enabled

Heres my story:


One day after long time i try log in and play on my account and i got ”account disabled” message.

Then i look my account on runescape account page and i see there message ”macroing major (ban)”.

I knew i never ever used macros/bots and played osrs only using offical client so i made ban appeal.


My email and password was same and i had authenticator enabled always.

I disable authenticator and try log in after that and got ”account disabled” message still.

I tried enable authenticator again but cant so i have to leave it disabled and wait i got my account back enabled.


Next day i tried just for fun log in my account and im suprised my account was enabled and i log in game.

I enabled right away authenticator back.


I shocked when i saw im on lumbridge couse i remember i leave my account on g.e last time..

Then i go check my bank and my bank pin was disabled and my +200m bank was cleaned...

My password and email was same all the time so hacker didnt changed those.

I didn recive message on runescape site, email about that my account was enabled or eny other messages when i was game break.

My contact email address is correct my used and hacker didnt changed that.

I had authenticator on and someone can still log in my account, used it and clean my bank.

I had authenticator always on and i use authenticator my emails too..


I know pishing site scams well and so thats not option.

I had ~200m bank, 99 slayer, alot gaming hours on osrs etc so i be very carefull whit my account and protection.

I used now and most of time my windows 10 gaming pc and apple phone when i played osrs and my pc is malware free.

Couple years ago i used linux pc for gaming only osrs and news sites sometime.

I run malwarebytes scan and nothing found.

I use for authenticator apple phone miscrosoft app (before google app)

On my phone i check emails everyday.

I have face id and pin securing my phone and email/authenticator app.


Im so confused how someone did this hack becouse i had authenticator allways on and bank pin to protect my bank and give that couple days for recovery if someone somehow get in my account.

I trusted authenticator like a wall and i used app and phonenumber authentication everywhere where it can be set on.


I have some whitehat hobby hacking backround so i know some things about internet/software security and be carefully whit my stuff.


Game was great and i enjoyed it but its time to quit forever. No time and interst rebuild enymore..