Phantom squatting, attackers buying the fake domains AI keeps hallucinating

[NeverQuitZach33]

Palo Alto Unit 42 has a name for a clever new trick, phantom squatting. Models keep inventing web addresses that do not exist, and attackers now register those made up domains first, then host phishing pages on them to catch traffic that AI tools point at. No phishing email needed, the model does the pointing for you

The scale of the study is what got me. They asked two AI models 685,339 questions about 913 well known brands and the models produced 2.1 million links. Threat intel had already flagged 13,229 of those as outright malicious. That is a lot of misplaced trust getting handed out automatically

The core problem is trust. Developers and AI assistants increasingly treat the links a model returns as real, so whoever grabs a hallucinated domain first inherits all that trust. It weaponizes a known failure mode of language models instead of fighting it. That is a creative bit of adversarial thinking

This one bugs me because there is no clean fix. You cannot easily stop models from hallucinating domains, and you cannot pre register every possible fake address. The best defense is probably tooling that verifies a domain actually predates the query. Until then, do not blindly trust a URL an assistant hands you

Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malwarethehackernews.com

[Grace31]

Weaponizing hallucinations instead of fixing them is dark and clever. Respect the ingenuity, hate the outcome

[Violet Caitlin]

2.1 million links and 13k already malicious. The attack surface is enormous

[Sharp Scholar]

There is no clean fix here and that is what makes it nasty

[JayJ]

Verify the domain predates the query is a decent heuristic. Someone should build that into the tools

[Matt_81]

Stop trusting URLs your assistant gives you. Basic hygiene now apparently

[Totally]

This is going to get worse as more people wire agents directly into browsers

[Callum28]

Registrars could help by flagging bulk registration of AI plausible domains but they wont

[GradientPiston]

The trust inheritance angle is the scariest part. The model launders credibility onto a phishing page

[Kieran_44]

How do you even defend at scale. Blocklists cannot keep up with generative naming

[SortedBuilder]

Great, another failure mode that ships enabled by default