Intel Utility Hijacked in AppDomain Attack to Launch Malware

Gbhackers •Mayura Kathir • April 20, 2026

Hackers are abusing a trusted Intel utility to quietly launch advanced malware by hijacking the .NET AppDomain mechanism, allowing malicious code to run inside a signed executable and evade many enterprise defenses. The campaign, dubbed Operation PhantomCLR by researchers, targets financial and other organizations in the Middle East and wider EMEA region using highly targeted […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Operation PhantomCLR: Advanced AppDomain Hijacking Targets Financial Sectors A sophisticated cyber attack campaign, named Operation PhantomCLR, has been identified, targeting organizations in the Middle East and EMEA financial sectors. The attackers exploit a legitimate Intel utility, IAStorHelp.exe, using .NET AppDomainManager to execute malicious code without altering the original signed binary. This method allows the malware to bypass traditional security measures, including EDR and antivirus solutions. Once the command-and-control communication is established via Amazon CloudFront, attackers can access sensitive data such as credentials and financial records. The malware employs anti-forensic techniques to erase memory artifacts, complicating post-incident investigations. The attack demonstrates a significant evolution in attacker tradecraft, emphasizing the need for advanced detection mechanisms. Organizations affected should consider their systems fully compromised and prepare for potential lateral movement by the adversary. 3 sources 67

Extracted Entities

Intel Utility Hijacked in AppDomain Attack to Launch Malware

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Industries (1)

MITRE ATT&CK (1)