# Phantom Squatting: How Attackers Exploit AI-Hallucinated Domains for Large-Scale Phishing


Artificial intelligence systems are remarkably sophisticated, but they are not infallible. One of their most persistent quirks is the tendency to fabricate plausible-sounding but entirely nonexistent facts—a phenomenon known as "hallucination." Security researchers have identified a troubling new attack vector that weaponizes this AI weakness: attackers are registering domain names that large language models invent during conversations, then hosting phishing pages and malware on those fake domains to intercept traffic directed there by unsuspecting AI users.


Palo Alto Networks' Unit 42 research team has termed this attack pattern phantom squatting, and their investigation reveals it is already occurring in active campaigns. The implications are significant: as AI tools become increasingly embedded in workplace workflows and everyday internet use, the attack surface expands in ways that traditional cybersecurity defenses were never designed to address.


## The Threat: When AI Invents Attack Infrastructure


At its core, phantom squatting exploits a fundamental weakness in how large language models operate. When users ask LLMs for examples, recommendations, or specific information, these models sometimes generate domain names, URLs, or service addresses that sound authentic but do not actually exist. A user might ask ChatGPT or another AI assistant for "the best cybersecurity training website," and the model might respond with something like securecorptraining-certified.com—a domain the AI fabricated because it fit the pattern of what a real site might be named.


Attackers have begun systematically identifying these hallucinated domains and registering them before legitimate businesses, researchers, or anyone else can claim them. Once registered, threat actors populate these sites with convincing phishing pages or malware delivery mechanisms, essentially creating honeypots specifically designed to catch traffic from AI-directed users.


Why this works:


  • Trust transfer: When an AI tool recommends a domain, users perceive it as trustworthy
  • Low scrutiny: Users are unlikely to question a resource suggested by a tool they already trust
  • High click rates: Victims are actively seeking the "service" the AI recommended
  • Detection evasion: These domains are newly created and may avoid some threat intelligence databases
  • Scale: Attackers can harvest thousands of hallucinated domains from public AI conversations or by prompting models directly

    • ## How AI Hallucinations Create Attack Infrastructure


    The mechanics of phantom squatting involve several key steps:


    1. Harvesting hallucinated domains


    Attackers prompt AI models with requests designed to elicit made-up domains. Queries like "What are the top 10 enterprise password management vendors?" or "Which healthcare compliance platforms are most recommended?" often produce a mix of real and fictional company names. Threat actors can also monitor public conversations, social media, and documented AI-generated content to identify fabricated domains at scale.


    2. Registering the phantom domains


    Using domain registration services like Namecheap, GoDaddy, or others, attackers purchase these nonexistent domains for minimal cost—often just $10–15 per year. There is no competition for these domains because they did not exist in anyone's mind until the AI invented them. Registration is straightforward and requires minimal verification.


    3. Hosting malicious content


    Once registered, these domains are configured with SSL certificates (often free via Let's Encrypt) and populated with convincing replicas of legitimate services:


  • Phishing pages designed to harvest credentials for banking, cloud services, or corporate systems
  • Fake login portals that capture two-factor authentication codes
  • Malware distribution sites hosting trojanized software, browser extensions, or documents
  • Tech support scams offering fake resolution to nonexistent problems

    • 4. Traffic capture


    When a user follows an AI recommendation and visits the phantom domain, they land on the malicious site. The attacker now has a direct engagement opportunity—a user actively seeking exactly what the attacker is offering.


    ## Background: The Wider AI Hallucination Problem


    AI hallucinations are not new. Researchers have documented them since the earliest large language models emerged. GPT-3, GPT-4, and other systems are known to occasionally fabricate citations, invent statistics, or generate plausible-sounding but false information. Organizations using AI tools have implemented various mitigation strategies—fact-checking, manual verification, and user training—but the issue remains endemic to how these models work.


    What has changed is adversarial awareness. Attackers have moved from passively benefiting from AI mistakes to actively exploiting them as a feature of their attack infrastructure. Phantom squatting represents a convergence of three trends:


    1. Widespread AI adoption: As ChatGPT, Claude, Gemini, and other tools become standard workplace tools, AI-directed traffic grows daily

    2. Predictable hallucination patterns: Attackers can reliably generate domain names that fit common hallucination profiles

    3. Low barrier to entry: Registering and hosting domains requires minimal investment or technical skill


    Unit 42's research shows that threat actors are already using this technique against organizations in finance, healthcare, and technology sectors.


    ## Technical Details: Domain Registration and Malware Hosting


    The infrastructure required for phantom squatting is deliberately minimal:


    | Component | Purpose | Cost |

    |-----------|---------|------|

    | Domain registration | Claim the hallucinated domain | $10–15/year |

    | SSL certificate | Appear legitimate (encrypted connection) | Free (Let's Encrypt) |

    | Hosting | Host phishing/malware pages | $3–10/month |

    | Email provider | Spoof legitimate communications | Free or $5–10/month |


    This low barrier to entry means individual threat actors or small groups can execute phantom squatting campaigns at scale. A single attacker can register hundreds or thousands of phantom domains for under $1,000 and operate them indefinitely for modest hosting costs.


    The malware payload itself is typically off-the-shelf commodity malware—credential stealers, info-stealers, or banking trojans—purchased from underground markets or developed using open-source tools.


    ## Implications for Organizations and Users


    Threat exposure:


    Organizations using AI tools in security operations, threat intelligence, incident response, or developer environments face elevated risk. An AI tool recommending a security tool, monitoring service, or compliance platform could lead employees directly into a phantom squatting attack.


    Credential and data theft:


    Phishing pages hosted on phantom domains can harvest credentials at scale. Organizations should assume that any credentials entered on a phantom domain are compromised and should reset them immediately.


    Supply chain implications:


    Enterprises that rely on AI-generated vendor recommendations or tool suggestions without verification could inadvertently integrate malware into their infrastructure.


    User behavior risk:


    End users trusting AI recommendations without verification are the primary attack vector. As AI becomes more prevalent, users may become more trusting of AI-generated advice, making them easier targets.


    ## Recommendations for Defense and Mitigation


    For organizations:


  • Implement AI output verification policies: Require human verification of any domains, URLs, or services recommended by AI tools before clicking or integrating them
  • Monitor domain registration trends: Track newly registered domains matching your organization name, products, or industry keywords
  • Deploy DNS filtering: Block known malicious domains through DNS-level filtering services
  • Educate employees: Train staff that AI tools can hallucinate and that verification is required
  • Implement zero-trust access: Use conditional access and additional authentication for any external resources recommended by AI

    • For users:


  • Verify before clicking: When an AI tool recommends a website, independently verify it exists (check official announcements, cross-reference in search results)
  • Use official channels: Go directly to a vendor's official website rather than following an AI-generated link
  • Report suspicious domains: Alert security teams if you encounter a domain that seems suspicious or doesn't load legitimately
  • Enable MFA everywhere: Multi-factor authentication reduces credential theft impact

    • For platform providers:


  • Flag hallucinations: AI platforms should detect and mark when they are generating potentially fabricated information
  • Cite verification: Require citations or verification status for domain recommendations
  • Safety by default: Implement guardrails that prevent models from confidently asserting information they cannot verify

    • ---


    ## HackWire Analysis


    Phantom squatting represents a category-shift in how attackers think about AI. Rather than exploiting AI as a target (stealing training data, performing adversarial attacks), they are now treating AI as an attack distribution channel—weaponizing the very trust users place in these tools.


    What makes this threat particularly dangerous is its scalability and the perverse incentive structure it creates. For years, cybersecurity taught users to be skeptical of links in emails and messages. But AI-generated recommendations carry an implicit endorsement that our threat models did not anticipate. A user asking ChatGPT for a tool recommendation is following *best practices*—consulting a trusted advisor—not clicking a suspicious link. The attacker's genius is hijacking that trust.


    The phantom squatting attacks Unit 42 documented are still relatively small-scale and targeted. But the barrier to entry is so low, and the ROI so high, that we should expect this to become a standard technique in the attacker playbook. As AI tools become embedded in security operations, incident response, and vendor evaluation, phantom squatting will become an increasingly direct path into enterprise networks.


    The defense is not complicated, but it is demanding: every domain, every URL, every recommendation coming from an AI tool must be independently verified by a human. This creates friction, which is exactly what attackers exploit. The organizations that will remain protected are those that embed verification as a non-negotiable step in their AI-assisted workflows.


    Organizations still operating under the assumption that "the AI tool said so" is sufficient justification to click a link or integrate a service should revise that assumption immediately.


    — *HackWire Editorial*


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Phishing](https://www.hackwire.news/category/phishing) and [Social Engineering](https://www.hackwire.news/category/social-engineering)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)