Executive Summary Publication Date: March 2026 The VOID#GEIST malware campaign represents a new frontier in multi-stage, script-based cyberattacks, delivering advanced Remote Access Trojans ( XWorm , AsyncRAT , and Xeno RAT ) through a highly modular and evasive framework. By leveraging legitimate tools such as embedded Python runtimes and Microsoft binaries, and employing fileless shellcode injection, VOID#GEIST is designed to evade traditional security controls and comp