CastleRAT and CastleLoader, active since March 2025, spread malware via phishing and GitHub repos, enabling data theft.

GitHub is where people build software. More than 150 million people use GitHub to discover, fork, and contribute to over 420 million projects.