Attackers Exploit AI Hallucinations to Send Users to Phishing Sites

Unit 42 researchers describe “phantom squatting,” an emerging phishing vector in which threat actors register domains hallucinated by LLMs and use them to host malicious content; analysis of 913 brands produced 2.1M URLs with 13,229 confirmed malicious links and roughly 250,000 unregistered hallucinated domains, and attackers have demonstrated the ability to register and deploy phishing sites within hours (including use in a kit called “Montana Empire”).