Researchers have uncovered a multi-stage malware campaign called VOID#GEIST that uses obfuscated batch scripts to deliver encrypted remote access trojans (XWorm, AsyncRAT, Xeno RAT). The attack chain employs a fileless execution method, injecting decrypted shellcode into memory to avoid disk detection and mimic legitimate administrative activity. It begins with a phishing email delivering a batch script, which displays a decoy PDF as a distraction while establishing persistence and fetching encrypted payloads. The malware uses an embedded Python runtime to decrypt and execute the final RAT payloads directly in memory.