Operation PhantomCLR: Stealth Execution via AppDomain Hijacking and In-Memory .NET Abuse