Tiny11 Builder runs a script that strips out most of Windows 11's apps, the telemetry, and the need for a Microsoft account.

CastleRAT and CastleLoader, active since March 2025, spread malware via phishing and GitHub repos, enabling data theft.