Shell to pay: Crims invade your PC with CastleRAT malware, now in C and Python

Recorded Future and related reporting describe TAG-150's CastleRAT malware — available in Python and C variants — spread via ClickFix social-engineering that tricks users into pasting malicious commands. The C build provides info-stealing capabilities (keystroke capture, screenshots, persistence) while the Python build prioritizes stealth; the group operates as a malware-as-a-service provider, uses encrypted Tox C2 and cloud hosting, and has demonstrated measurable success in persuading victims to self-install malware.