Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware

Unit 42 warns of "phantom squatting": LLMs consistently invent non-existent domains, attackers pre-register those domains and launch phishing sites and malicious apps that steal payment and identity data. The report documents multiple real-world cases where hallucinated domains were registered and weaponized, highlights that models' consistent hallucinations make targets predictable, and recommends monitoring predicted fake domains and preventing automated agents from following unverified AI-generated links.