Attackers register AI-hallucinated domains for phishing and malware campaigns
Unit 42 researchers documented that attackers are registering web domains hallucinated by large language models, then using these fake domains to deploy phishing sites and malware that AI systems recommend to users. The research found over 250,000 unregistered hallucinated domains that could be exploited, with real-world attacks including a phishing kit called Montana Empire.
What happened
Unit 42 researchers found that large language models consistently hallucinate web domains for legitimate brands. Adversaries are actively registering these nonexistent domains before they are recommended by AI assistants, intercepting traffic intended for legitimate services.
The researchers analyzed 913 global brands and executed 685,339 URL queries across two LLM models, generating 2.1 million URLs and revealing 13,229 confirmed malicious URLs. Approximately 250,000 hallucinated domains remain unregistered, creating targets for attacker preemption.
A standout case shows attackers building a phishing kit named Montana Empire using an AI coding assistant, targeting a hallucinated domain researchers identified as high-risk 23 days before the attacker registered it.
Reported impact
The attack technique, called phantom squatting, poses a significant risk to the software supply chain, as developers and autonomous AI agents could unknowingly send sensitive information to attacker-controlled infrastructure.
Researchers note that newly registered hallucinated domains carry no threat intelligence history, established reputation score or blocklist entries, enabling a zero-reputation bypass that evades traditional security defenses.
Index analysis
The threat extends concepts from slopsquatting, which involved AI inventing nonexistent software package names, to web infrastructure by targeting domains. Attackers exploit predictable hallucination patterns by probing AI models, registering domains rapidly, and deploying phishing pages or malware for the AI systems to recommend.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.