Large language models (LLMs) have been found to consistently generate nonexistent web domains for legitimate brands, a phenomenon researchers are calling "phantom squatting." Adversaries are actively registering these AI-hallucinated domains to intercept traffic, posing a significant new risk to the software supply chain.
Researchers from Unit 42, the threat intelligence arm of Palo Alto Networks, conducted an analysis of 913 global brands, executing 685,339 URL queries across multiple configurations of two distinct LLM models. This process generated 2.1 million URLs, revealing over 13,229 confirmed malicious URLs. Additionally, approximately 250,000 hallucinated domains were discovered that remain unregistered, presenting a substantial opportunity for exploitation.
The research indicates that attackers can predict the use of these phantom domains between 18 and 51 days before adversary registration. In one confirmed instance, an attacker leveraged an AI coding assistant to develop a phishing kit named "Montana Empire." This kit targeted a domain that Unit 42's detection pipeline had identified as a high-risk hallucination target 23 days earlier, illustrating the full attack cycle from AI-assisted development to exploitation of an LLM-hallucinated domain.
LLMs are increasingly integrated into the software development lifecycle, with developers consulting AI coding assistants for documentation links, and enterprise CI/CD pipelines using AI assistants to recommend third-party service endpoints. When an LLM generates a URL, it may be directly ingested by autonomous AI agents, integrated into production code by developers, suggested as an authoritative endpoint, or included in automated documentation. In these scenarios, the LLM acts as a trusted supply chain dependency, making its output, including hallucinated URLs, susceptible to exploitation.
This new threat extends prior research on "slopsquatting," where LLMs hallucinate nonexistent software package names. Phantom squatting applies this adversarial logic to web infrastructure, with LLMs generating fictitious domains for web portals, API endpoints, or corporate services. Examples include a coding assistant generating an unregistered benefits portal URL, an AI research agent producing a plausible banking portal domain, or a developer unknowingly integrating an AI-generated API endpoint into their code, directing data to an attacker-controlled server.
Traditional URL filtering and threat intelligence frameworks are often ineffective against phantom squatting because they rely on historical reports of malicious activity or require a domain to accumulate a reputation before classification. A newly registered phantom domain carries no threat intelligence history, has no established reputation score, and lacks any blocklist entries, effectively bypassing conventional defenses. The domain appears legitimate because it originates from the LLM's own language patterns.
The phantom squatting attack lifecycle involves four phases: Discover, Act, Lure, and Bypass. The "Discover" phase involves adversarial probing of LLM hallucination patterns, where attackers systematically query models with realistic prompts to map the resulting phantom domains. In the "Act" phase, attackers register these hallucinated phantom domains before defenders can react. The "Lure" phase involves directing users or automated systems to these attacker-controlled domains, and the "Bypass" phase exploits the lack of reputation or threat intelligence associated with these newly registered domains.
