CastleRAT and CastleLoader, active since March 2025, spread malware via phishing and GitHub repos, enabling data theft.

This time, it's a Python-scripted remote access trojan (RAT) that emerged in recent weeks alongside a new spate of targeted attacks.