# Phantom Squatting: How AI Hallucinations Are Creating a New Supply Chain Attack Vector
Artificial intelligence researchers have identified a troubling new attack technique called "phantom squatting" that exploits a fundamental weakness in large language models: their tendency to invent plausible-sounding web domains for legitimate brands. Unlike traditional domain squatting, this attack doesn't target typosquatting opportunities—instead, cybercriminals are weaponizing the AI hallucinations themselves, registering fake domains that LLMs generate and directing unsuspecting users toward malicious infrastructure. The discovery underscores how deeply embedded AI systems have become in enterprise workflows and how that trust is now being weaponized against the software supply chain.
## The Threat
Phantom squatting represents a uniquely dangerous exploitation of how large language models work. When developers, security researchers, or business users query AI assistants—whether ChatGPT, Claude, or enterprise-deployed models—these systems frequently generate plausible but nonexistent web addresses for legitimate companies. An LLM might invent a benefits portal URL for a Fortune 500 company, fabricate an API endpoint for a banking institution, or hallucinate a support portal for a cloud provider. These domains sound authentic and follow realistic naming conventions, making them difficult to distinguish from genuine assets.
The attack unfolds in three stages:
1. LLM Hallucination — An AI model generates a fictitious domain that sounds credible for a target brand
2. Domain Registration — Attackers proactively register these hallucinated domains before legitimate use
3. Traffic Interception — Users following AI-generated instructions land on attacker-controlled infrastructure for phishing, malware delivery, or credential theft
What makes phantom squatting particularly dangerous is its scale and invisibility. Unlike traditional phishing campaigns that require extensive reconnaissance, attackers can automate the discovery of hallucinated domains by querying LLMs millions of times and rapidly registering any nonexistent domains they generate.
## Background and Context
The attack was formally documented by researchers at Palo Alto Networks' Unit 42 in a comprehensive study published June 30, 2026. The team analyzed 913 global brands using 685,339 URL queries across two distinct LLM models, generating approximately 250,000 hallucinated domains. Alongside these hallucinations, the researchers identified over 13,220 confirmed malicious URLs already associated with these same brands—suggesting phantom squatting campaigns are already active in the wild.
This research reveals a critical vulnerability in how LLMs handle factual queries about real-world entities. The problem parallels an earlier-identified weakness in which LLMs hallucinate fictional software package names. A developer asking an AI assistant to "show me popular Python libraries for image processing" might receive a convincing recommendation for a package that doesn't actually exist in any registry. Similarly, when querying about corporate infrastructure, LLMs confidently generate domains that sound real but have never been registered.
The timing of this discovery is particularly concerning because LLMs have now become trusted supply chain dependencies in many enterprises. Developers routinely use AI coding assistants to generate infrastructure recommendations, security researchers use LLMs to research threat intelligence, and business users leverage these tools for vendor research. Each of these interactions represents a potential attack surface.
## Technical Details
### The Research Findings
Palo Alto Networks' analysis reveals the scope and consistency of the hallucination problem:
| Metric | Finding |
|--------|---------|
| Global Brands Analyzed | 913 across multiple sectors |
| URL Queries Executed | 685,339 queries across LLM configurations |
| Hallucinated Domains Generated | ~250,000 fictional domains |
| Confirmed Malicious URLs Found | 13,220+ already in the wild |
| Models Tested | 2 distinct LLM architectures |
The consistency of hallucinations across different LLM configurations indicates this is not a rare edge case but a systemic behavior in how these models generate domain names.
### Exploit Pathways
Unit 42 identified three primary attack patterns:
1. Benefits Portal Interception
An AI coding assistant generates a plausible benefits portal URL for a target company (e.g., benefits.company-internal.io). An attacker registers this domain and hosts a phishing page. Employees directed to this URL through AI-generated documentation enter credentials that are harvested by the attacker.
2. Banking and Financial Portals
AI research agents tasked with financial intelligence generate fictional banking portals or payment processor endpoints. Attackers preemptively register these domains to capture traffic from users following AI-provided instructions during account setup or troubleshooting workflows.
3. API Endpoint Hijacking
A developer queries an LLM for API documentation or integration guidance. The model generates a convincing but nonexistent API endpoint. An attacker registers the domain and hosts malicious API responses, potentially compromising downstream applications that consume this data.
### Real-World Campaign Evidence
The threat moved from theoretical to active in June 2026 when researchers discovered an attacker who had used an AI coding assistant to build a complete phishing kit targeting one of the phantom domains identified in the research. The attacker leveraged the same AI tools available to defenders to accelerate the development of attack infrastructure—a sophisticated example of how dual-use AI capabilities can accelerate both offense and defense.
## Implications for Organizations
The discovery of phantom squatting creates several categories of risk:
For Software Development Organizations:
Developers using AI coding assistants to generate infrastructure diagrams, API specifications, or deployment instructions may unknowingly incorporate fictional domain references into production systems. If these instructions are later followed by team members or automated systems, traffic could be directed to attacker-controlled domains.
For Enterprise Security Teams:
This attack vector bypasses many traditional security controls. URL filtering might miss these domains because they're tailored to specific organizational contexts (competitor research, vendor evaluation, internal infrastructure). Email security tools may not flag links to these domains because they appear to be from legitimate brands.
For Supply Chain Risk Management:
Because LLMs are now used to evaluate vendors, research third-party services, and gather competitive intelligence, phantom squatting creates an indirect supply chain vulnerability. Users following AI-generated leads may be directed to fake vendor portals or compromised infrastructure.
For End Users:
Anyone using AI assistants for technical support, research, or configuration help is at risk if they follow links generated by the model without independent verification.
## Recommendations
For Enterprise Organizations:
For Individuals Using AI Assistants:
---
## HackWire Analysis
This research exposes a critical inflection point in how AI has been integrated into enterprise security and development workflows. We've rushed to adopt LLMs as trusted advisory tools without building verification layers, and phantom squatting exploits that exact blind spot.
What makes this particularly insidious is the meta-vulnerability at play: attackers aren't compromising the AI system itself—they're exploiting the *trust* that users place in AI outputs. This is fundamentally different from traditional supply chain attacks that target vulnerable dependencies or authentication mechanisms. Instead, phantom squatting weaponizes the semantic plausibility of LLM hallucinations. A domain like auth.companysecure-verify.com or api-gateway.cloudservices-internal.net *sounds* legitimate because LLMs generate text based on statistical patterns of real infrastructure.
The pattern recognition angle is critical: this is the latest evolution of a broader trend where AI-assisted attack tooling is maturing alongside AI-assisted defense. We've already seen AI coding assistants used to generate malware, bypass security controls, and craft targeted phishing campaigns. Phantom squatting represents a new layer of sophistication—it doesn't just use AI to build attacks faster; it exploits the fundamental way AI systems hallucinate to create a supply chain vulnerability at scale.
The hidden risk many organizations are missing is that they're *already exposed*. Developers have been using LLMs to build infrastructure diagrams, security researchers have been querying models for threat intelligence, and business teams have been using AI to research vendors. Any of those queries may have resulted in hallucinated domains that are now controlled by attackers. Organizations need to treat this as an active threat, not a theoretical future concern.
The concrete next step is urgent: enterprises need to implement immediate verification workflows for any domain references generated by LLMs, particularly in security-sensitive contexts. This means never clicking a link from an AI assistant without independent confirmation, requiring human review of AI-generated infrastructure documentation, and proactively monitoring for registration of hallucinated domains related to your brand. For larger organizations, consider deploying internal LLM monitoring to track which domains your models are generating and flag fictional ones for protective registration.
This is a watershed moment for AI governance in security. The industry adopted LLMs as trusted tools before we understood the full scope of their failure modes. Phantom squatting is the proof point that we need verification layers, not blind trust.
— HackWire Editorial
---
## Related Coverage