Hackers Use AppDomain Hijacking to Turn Trusted Intel Utility Into Malware Launcher

Cybersecuritynews •Tushar Subhra Dutta • April 20, 2026

Security researchers have uncovered a highly sophisticated attack campaign that weaponizes a legitimate, digitally signed Intel utility to secretly deploy malware, all without touching a single line of the original program’s code. The campaign, dubbed Operation PhantomCLR, represents a serious evolution in how advanced attackers hide inside trusted systems to avoid detection. The attack exploits a […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation PhantomCLR: Advanced AppDomain Hijacking Targets Financial Sectors A sophisticated cyber attack campaign, named Operation PhantomCLR, has been identified, targeting organizations in the Middle East and EMEA financial sectors. The attackers exploit a legitimate Intel utility, IAStorHelp.exe, using .NET AppDomainManager to execute malicious code without altering the original signed binary. This method allows the malware to bypass traditional security measures, including EDR and antivirus solutions. Once the command-and-control communication is established via Amazon CloudFront, attackers can access sensitive data such as credentials and financial records. The malware employs anti-forensic techniques to erase memory artifacts, complicating post-incident investigations. The attack demonstrates a significant evolution in attacker tradecraft, emphasizing the need for advanced detection mechanisms. Organizations affected should consider their systems fully compromised and prepare for potential lateral movement by the adversary. 3 sources 67

Extracted Entities

Hackers Use AppDomain Hijacking to Turn Trusted Intel Utility Into Malware Launcher

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

MITRE ATT&CK (1)