Invalid

so my account got cleaned out on the 7th. posting because i think anyone who
used this client is at risk.

what happened. i used hydraclient from about nov 2024 til i deleted it 21 july.
changed my jagex password 4 july while it was still installed. then on 7 sept
around 22:30 i got an email from jagex saying login from the united states.
woke up to an empty bank. they didnt change my password or email or remove 2fa,
i still had the account.

spent a while going through my pc trying to work out how. what i can rule out:

- hydraclient is the only custom client ive ever used. everything else was
official plugin hub plugins, which the runelite launcher hash checks on every
startup. so theres nothing else this couldve come from
- my 2fa is email codes. no weird logins on my email at all. so they never read
a code, which means it wasnt a normal login
- no linked logins on my jagex account
- i had a bank pin. removing a pin takes 3 days and this was done in about 13
hours so they didnt wait it out, they just knew it
- my pc is clean. no malware, nothing running, and windows logs show nobody
logged into my machine that night

what that leaves is the launcher. the jagex launcher hands your refresh token
to whatever client you launch (JX_REFRESH_TOKEN etc) so the client can log you
in. thats normal, thats how it works. but it means any custom client you run
through it just gets given your token. it doesnt have to steal anything. and a
bank pin can only be seen from inside the client while youre typing it. those
are the exact two things that got used on me.

not saying for sure who did it. but thats where it points and the timing lines
up with the shutdown.

if you used it, do this. takes 2 min and you dont need the game installed:

1. change your jagex password. thats the bit that actually kills the token.
deleting the client does nothing, the token lives on jagex servers not on
your pc
2. check linked account logins in settings, remove anything thats not yours.
that survives a password change
3. new bank pin

also my password change on 4 july didnt help, because the client was still
installed for another 2 and a half weeks after. so if you changed yours while
still using it, assume that one is burned too.

anyone else get hit early september? trying to work out if this is just me or a
batch.