TLDR Tech / InfoSec
Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector
Unit 42 mapped 913 brands across two LLMs, generating 2.1 million URLs, of which 13,229 resolved to confirmed malicious infrastructure and roughly 250,000 collapsed into unregistered "phantom domains." Adversarial exploitation windows of 18–51 days between hallucination and registration gave defenders lead time via proactive watchlisting. In the flagship case, an attacker built the Montana Empire phishing kit with an AI coding assistant, targeting a domain Unit 42's pipeline had flagged 23 days earlier. A second campaign spoofing a national postal service delivered a malicious APK 51 days after prediction. Defenders should treat LLM-generated URLs as untrusted output requiring independent verification, register high-risk brand domain permutations preemptively, and monitor DNS registration event streams for known hallucination patterns rather than relying on reputation-based blocklists, which fail against zero-history infrastructure.
Read the full story