'Phantom Squatting': An Emerging AI-Driven Supply Chain Threat

Unit 42 research describes a new LLM-driven supply-chain threat called "phantom squatting," in which AI assistants hallucinate plausible domains for legitimate brands; attackers register those phantom domains, host phishing kits or malware (including an observed phishing kit "Montana Empire" and a malicious Android app), and intercept traffic or credentials. The report documents large-scale generation of hallucinated domains across hundreds of brands, timelines showing attackers registering high-risk hallucinated domains days to weeks after discovery, outlines exploit paths (developer assistants, AI agents, integrated API endpoints), and recommends verifying URLs against authoritative allowlists and restricting AI agents' ability to connect to arbitrary domains.