Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware

1. Executive summary

Palo Alto Networks Unit 42 has published research on "phantom squatting," a technique where attackers register domains that large language models (LLMs) hallucinate during user queries. Unit 42 generated 2.1 million links by asking two AI models 685,339 questions about 913 well-known brands; 13,229 returned links were already flagged as malicious and roughly 250,000 invented domains were unregistered and available for purchase. Two confirmed in-the-wild cases show attackers registering predicted hallucinated domains and deploying phishing kits (one named "Montana Empire") and malicious Android apps against targets including a national postal service marketplace, a major UAE bank, a European bank, and sports-betting sites. EMEA financial services clients face elevated risk because the attack vector exploits structural LLM properties that Unit 42 assesses as "inherently unpatchable," and because brand-trust bypass occurs without traditional phishing infrastructure — no malicious email or ad is required.

2. Regulatory framing

3. Technical analysis & attack chain

Attack chain (confirmed steps from Unit 42 research)

1. LLM domain hallucination. An LLM, when queried about a brand or service, generates a domain name that does not exist. Unit 42 tested two models across 685,339 questions covering 913 brands in technology, finance, healthcare, government, gambling, and other sectors. The models produced 2.1 million links. The hallucinated domains are generated from the models' language patterns, not from training data — both models shipped before the real malicious sites existed.
2. Cross-model consistency. Different models invent the same fake domain for the same query. Increasing a model's "creativity" (temperature) setting produces additional invented domains. This predictability makes attacker target selection straightforward.
3. Domain registration by attacker. An attacker registers the hallucinated domain before the legitimate brand owner. A freshly registered domain has no reputation history, so blocklists, threat feeds, and reputation scores have nothing to flag.
4. Infrastructure deployment. The attacker hosts phishing content, malicious applications, or malware on the newly registered domain. Traffic arrives via AI tools that present the domain to users as legitimate.
5. Victim engagement. Users follow AI-generated links with inherent trust in the tool's output. No phishing email or malicious advertisement is required — the AI tool itself is the delivery vector.

Confirmed in-the-wild cases

Case 1 — National postal service marketplace (March 2026)

• On 2026-03-08, Unit 42's system predicted that AI models would invent a domain resembling a national postal service's online marketplace. Both tested models generated the same domain at every temperature setting.
• On 2026-03-31 (23 days later), an attacker registered that exact domain.
• The attacker deployed a phishing kit named Montana Empire. The kit cloned the real storefront in real time.
• Data stolen: card numbers, bank-transfer details, national ID data.
• A Telegram bot was used by the operator to manually approve victims' one-time passcodes (OTP interception).
• Leftover project files and session logs on the attacker's infrastructure showed the criminal had built the kit using an AI coding assistant — attacker and defender converged on the same hallucinated domain via AI.

Case 2 — Postal-service domain with malicious Android app

• Unit 42 flagged a hallucinated postal-service domain 51 days before an attacker registered it.
• The attacker created a pixel-perfect brand clone, added a fake 4.8-star rating and a claim of over two million users.
• The site was used to push a malicious Android app.

Additional targets identified

• A major UAE bank — an attacker had already been abusing a hallucinated domain impersonating this bank for nearly a year.
• A European bank.
• Sports-betting sites targeting users in Bangladesh.

Related vector — slopsquatting (software supply chain)

• A USENIX study found that code-generating models routinely suggest package names that do not exist.
• The PhantomRaven campaign exploited this by creating malware hidden in 126 npm packages with more than 86,000 installs.
• Phantom squatting is the domain-name analogue of this technique.

Structural properties

Unit 42 assesses that the vector "exploits a structural property of LLM architectures that remains inherently unpatchable." The hallucinated domains arise from language-pattern generation, not from retrievable training data, meaning model retraining or patching cannot eliminate the behaviour.

Confidence caveat

All technical detail in this section is single-sourced — derived solely from the Palo Alto Unit 42 research as reported via The Hacker News. No independent corroboration of the specific IOCs, case details, or the "Montana Empire" phishing kit has been identified in the provided source material. Verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Inventory AI tool exposure. Identify all LLM-based services in use across the organisation (developer coding assistants, customer-facing chatbots, internal search/retrieval tools, AI-enhanced email or document tools). Document which models are in use and whether they generate URLs or package names in user-facing or developer-facing output.
• Block known-malicious domains from Unit 42 dataset. The research identified 13,229 links already flagged as malicious. If Unit 42 publishes the full indicator list, ingest it into DNS filtering, proxy blocklists, and EDR web-content filtering rules immediately. (Note: the full list was not included in the provided source material — monitor the Unit 42 post at https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/ for publication.)
• Alert on brand-impersonation domain registrations. Configure domain-monitoring services (e.g., certificate transparency log monitoring via ct-search, domain-registration monitoring via WHOIS feeds) to alert when new domains are registered that closely resemble the organisation's brand names, trading names, or product names — especially combinations that an LLM might generate (e.g., {brand}-online.com, {brand}-portal.com, {brand}-secure.com).

P2 — Within 72 hours

• Deploy AI-output validation controls. For any internal or customer-facing AI tool that generates URLs:
• Implement a real-time domain-reputation check against threat feeds before presenting URLs to users.
• Strip or flag any URL whose domain is freshly registered (e.g., registered within the last 90 days) or has no established reputation.
• Log all AI-generated URLs for retrospective analysis.
• Developer pipeline controls. For CI/CD pipelines that may ingest AI-generated package names:
• Implement allow-listing for package registries (npm, PyPI, etc.) so only known-good packages can be installed.
• Block installation of packages with zero download history or freshly published timestamps.
• Scan for the 126 PhantomRaven npm packages if a list is published by Unit 42.
• Customer-facing controls. If the organisation operates customer-facing AI chatbots or search tools, implement user-visible warnings when AI-generated links are presented, and ensure links pass through the organisation's existing secure web gateway before reaching users.

P3 — Within 7 days

• Threat-hunt for phantom-squatting infrastructure. Search DNS logs, proxy logs, and email security gateway logs for traffic to domains matching the patterns described:
• Domains resembling the organisation's brand that were registered recently.
• Domains identified in the Unit 42 research as targeting financial-sector brands (UAE bank, European bank).
• Review OTP delivery and verification processes. The Montana Empire kit used a Telegram bot for manual OTP approval. Review and strengthen OTP delivery channels to ensure they cannot be bypassed via social-engineering or real-time interception. Ensure customer-facing guidance warns against entering OTPs on sites reached via AI-generated links.
• Engage brand-protection / takedown services. For confirmed impersonating domains, initiate takedown requests through the organisation's brand-protection vendor or legal counsel.
• Brief development teams. Communicate the slopsquatting risk to all development teams using AI coding assistants. Require manual verification of any package name, domain, or URL suggested by an AI tool before use.

5. Indicators of compromise

Note: No specific domain names, IP addresses, file hashes, or package names were included in the provided source material. The specific hallucinated domains observed by Unit 42 were not disclosed in the article. The 13,229 flagged malicious links and ~250,000 unregistered domains were referenced as aggregate counts only. Monitor the Unit 42 primary research post for any published IOC list.

No indicators of compromise available in the source material in actionable form (no domains, IPs, hashes, or package names were disclosed).

6. Detection

The source material contains technique names and campaign names but no specific file artefacts, hashes, registry keys, mutex names, or hard-coded strings suitable for YARA rule construction. No log-based behavioural indicators with specific process names, network signatures, or registry paths were provided.

However, the following Sigma rule can be constructed from the behavioural indicators described in the source — specifically, the Telegram-based OTP interception infrastructure used by the Montana Empire phishing kit:

title: Potential Montana Empire Phishing Kit Telegram C2 Communication
id: 0c7e1f2a-3b4d-4e5f-8a9b-0c1d2e3f4a5b
status: experimental
description: >
  Detects potential communication to Telegram bot infrastructure associated with
  the Montana Empire phishing kit, as described in Unit 42 phantom squatting
  research. The kit uses a Telegram bot for manual OTP approval. This rule
  flags traffic to Telegram API endpoints from non-standard processes, which
  may indicate C2 communication by phishing kits that abuse Telegram for
  real-time OTP interception.
references:

  - https://thehackernews.com/2026/07/phantom-squatting-uses-ai-hallucinated.html
  - https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/
author: Adverse Trace
date: 2026/07/01
logsource:
  product: windows
  category: network_connection
detection:
  selection:
    DestinationHostname|contains:

      - "api.telegram.org"
      - "t.me"
  filter_legitimate:
    Image|endswith:

      - "\\Telegram.exe"
      - "\\telegram-desktop.exe"
      - "\\tdesktop.exe"
  condition: selection and not filter_legitimate
falsepositives:

  - Legitimate applications using Telegram Bot API for notifications
  - Internal automation tools using Telegram as a transport
level: medium

Caveat: This Sigma rule is constructed from the behavioural description in the source material. The specific Telegram bot handle or API token used by the Montana Empire kit was not disclosed. The rule is broad by necessity — it flags non-standard processes communicating with Telegram infrastructure, which is the pattern described. Single-sourced; verify before enforcement.

7. Sources

• The Hacker News — "Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware" — https://thehackernews.com/2026/07/phantom-squatting-uses-ai-hallucinated.html — 2026-07-01
• Palo Alto Networks Unit 42 — "Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector" — https://unit42.paloaltonetworks.com/phantom-squatting-hallucinated-web-domains/ — accessed 2026-07-01

8. Adverse Trace position

Severity assessment: is appropriate. No CVE is associated with this item — the vector is a structural property of LLM architectures, not a patchable software vulnerability. Verified reference data resolved no CVEs for this item, and no CISA-KEV entry exists. The risk to EMEA financial services is elevated because the technique bypasses traditional phishing delivery mechanisms (no email, no malvertising) and exploits trust in AI tool output. Two confirmed in-the-wild cases demonstrate end-to-end exploitation from domain prediction through phishing-kit deployment and data theft. The targeting of a UAE bank and a European bank directly engages EMEA financial services clients. Attribution is to unnamed individual actors; no named threat actor with a MITRE profile is identified in the source material — attribution is unconfirmed. All technical detail is single-sourced (Unit 42 via The Hacker News); verify before enforcement. Adverse Trace will monitor the Unit 42 primary research post for publication of the full IOC list (13,229 malicious domains, ~250,000 unregistered domains) and will issue a follow-up advisory if actionable indicators are released. Clients should implement P1 controls immediately, with particular focus on brand-impersonation domain-registration monitoring and AI-output validation controls.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.