Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware
Summary: Palo Alto Networks' Unit 42 documented 'phantom squatting,' in which attackers register domains that large language models invent and host phishing pages on them, after querying two AI models with 685,339 questions about 913 brands and collecting 2.1 million links. Of those links, 13,229 were already flagged as malicious and roughly 250,000 of the invented domains had no owner, and in one case Unit 42 predicted a fake postal-service domain on March 8, 2026, that an attacker registered 23 days later with a phishing kit named Montana Empire.
Key Takeaway: A freshly registered phantom domain has no reputation history, so blocklists and threat feeds have nothing to flag until after victims have already been sent there by a tool they trust. Unit 42 flagged one hallucinated postal-service domain 51 days before an attacker registered it, which means the warning window exists but rewards whoever moves first.
Read the original at The Hacker News ↗
- Topics
- Zero-Days & Exploits
- Related
- New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026