CastleRAT and CastleLoader, active since March 2025, spread malware via phishing and GitHub repos, enabling data theft.

Once a malicious file is placed in these folders, it can install malware or open a hidden backdoor without any further action from the user.