Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware
A new attack vector called 'phantom squatting' involves attackers registering non-existent domains that AI models hallucinate, then using them for phishing and malware distribution.
Intelligence analysis by Gemini 2.5 Flash
Attackers are exploiting a vulnerability in large language models (LLMs) where AI assistants consistently invent web addresses that do not exist. By registering these 'phantom' domains first, threat actors can host malicious content, leveraging the inherent trust users place in AI-generated links to bypass traditional security filters.
Imagine a smart robot that sometimes makes up fake street names. Bad guys are listening, and when the robot invents a new fake street, they quickly buy the land on that street and build a fake candy store there. If you ask the robot for a candy store, it might tell you about the fake one, and because you trust the robot, you might go there and give your money to the bad guys. So, always double-check if a place is real, even if a smart robot tells you about it!
Analysis
The Inherent Vulnerability of AI Hallucinations
Large language models, despite their advanced capabilities, possess a structural property that makes them prone to 'hallucinating' information, including non-existent web domains. This phenomenon, termed 'phantom squatting' by Palo Alto Networks' Unit 42, occurs when AI models invent domain names that were never part of their training data. Crucially, these hallucinations are often consistent, meaning different models or repeated queries can generate the same fake domain, making them predictable targets for attackers.
Attackers exploit this by proactively registering these AI-invented domains. Since these are brand-new registrations, they lack any negative reputation history, allowing them to bypass conventional security filters like blocklists and threat feeds. By the time these domains are flagged as malicious, victims, trusting the AI source, may have already interacted with the phishing or malware sites, highlighting a critical gap in current defensive strategies.
Real-World Exploitation and Precedent
Unit 42's research has already identified active cases of phantom squatting. In one instance, a domain resembling a national postal service's online marketplace, consistently hallucinated by AI models, was registered by an attacker 23 days after prediction. This domain then hosted a sophisticated phishing kit, 'Montana Empire,' designed to steal sensitive financial and personal data. The attacker even used an AI coding assistant to build the kit, demonstrating a full circle of AI-driven offense.
Another case involved a hallucinated postal-service domain being registered 51 days after prediction, subsequently used to push a malicious Android app via a pixel-perfect brand clone. This attack vector mirrors 'slopsquatting,' where attackers register fake software package names invented by AI coding tools, as seen in the 'PhantomRaven' campaign. These examples underscore a broader trend: AI output is increasingly becoming unverified input for users and automated agents, shrinking the window for defenders to react.
Proactive Defense and User Vigilance
Given that AI models hallucinate consistently, security teams can adopt a proactive stance by mapping likely invented domains and monitoring their registration. This strategy offers a potential lead time of several weeks, allowing defenders to register these domains themselves or add them to blocklists before attackers can exploit them. This shifts the paradigm from reactive defense to predictive threat intelligence, turning a vulnerability into a potential early warning system.
For individual users and developers, the practical advice is straightforward: never blindly trust a link provided by an AI. It is imperative to verify the authenticity of any domain before entering credentials or integrating it into code. Furthermore, AI agents should be configured to prevent automatic opening or downloading from model-generated links without human verification. Treating all AI-generated content as an unverified draft, rather than an authoritative source, is crucial in mitigating the risks posed by phantom squatting.
Key points
- AI models consistently hallucinate non-existent web domains, creating a new attack surface called 'phantom squatting'.
- Attackers register these AI-invented domains to host phishing pages and malware, exploiting user trust in AI-generated links.
- Newly registered phantom domains bypass traditional security filters because they lack a negative reputation history.
- Observed cases include phishing kits stealing financial data and malicious Android app distribution.
- Security teams can proactively map and monitor likely hallucinated domains, while users must verify AI-generated links before trusting them.
Security teams can leverage the consistent nature of AI hallucinations to predict and monitor these phantom domains, potentially registering them before attackers or adding them to blocklists. This proactive approach could provide weeks of warning, allowing for more effective defense against this emerging threat.
The core vulnerability of AI models hallucinating domains is described as 'inherently unpatchable,' suggesting a persistent challenge. Attackers also benefit from the speed advantage of registering new domains before they acquire a negative reputation, making it a constant race against time for defenders.
