Phantom Squatting: How AI-Hallucinated Domains Fuel Phishing Attacks

Palo Alto Networks' Unit 42 has documented a new attack vector it calls phantom squatting, in which threat actors register domain names that large language models invent out of thin air and then weaponize those domains for phishing and malware delivery. The technique exploits a structural property of generative AI: when an LLM cannot recall an exact web address, it frequently fabricates one that looks plausible. Attackers who register those hallucinated domains before a legitimate owner inherits the implicit trust users place in AI-recommended links, bypassing the need for malicious email, malvertising, or search-engine poisoning.

In a recently published study, Unit 42 submitted 685,339 questions about 913 brands spanning technology, finance, healthcare, government, and gambling to two production LLMs. The models returned roughly 2.1 million URLs, of which 13,229 already appeared on threat intelligence feeds as known-malicious destinations. More striking, approximately 250,000 hallucinated domains were unregistered at the time of the study, each one a ready-made target for whoever reaches the registrar first. Defenders face a built-in disadvantage here: blocklists, reputation feeds, and automated filters all require observed misbehavior before flagging a site. A freshly registered phantom squatting domain carries no prior record and slips past detection until victims have already arrived. Security teams can vet unfamiliar endpoints with a WHOIS lookup to confirm ownership and registration age, while an SSL/TLS checker can expose whether a suspicious storefront is using a legitimate certificate or a self-signed stand-in.

Two observed incidents illustrate the full attack loop. On March 8, 2026, Unit 42 predicted both LLMs would fabricate a domain mirroring a national postal service's online marketplace, a forecast that held at every model temperature setting. Twenty-three days later, an attacker registered that exact address and deployed a phishing kit dubbed Montana Empire, which cloned the real storefront in real time to harvest card numbers, bank-transfer details, and national ID data. A Telegram bot let the operator manually approve victims' one-time passcodes, and leftover project artifacts confirmed the kit itself was assembled with an AI coding assistant, the same class of tool that hallucinated its target. A second case saw Unit 42 flag another fabricated enterprise-services domain shortly before it surfaced in active phishing lures, underscoring that defenders and attackers are converging on identical AI-generated targets.

Unit 42 concludes the vector remains inherently unpatchable because it stems from how transformer architectures generate probabilistic next tokens rather than from any fixable bug. Cranking up a model's creativity setting only multiplies hallucination rates, producing a larger candidate pool for attackers to squat. Organizations should treat every AI-sourced URL as untrusted by default, validate destinations before clicking, and watch newly registered domains that resemble their brand. Practitioners can extend the research by running suspect domains through a DNS leak test to confirm a site resolves where it claims, or by auditing certificate chains and DNS records for telltale anomalies on any AI-recommended link.