Unit 42 has named and documented ‘phantom squatting’, a technique that exploits the tendency of large language models to invent plausible-sounding web addresses.
Summary
- Large language models regularly generate URLs that do not exist — a known failure mode called hallucination.
- Researchers at Palo Alto Networks’ Unit 42 have confirmed attackers are registering these fabricated domains before legitimate parties can.
- Once registered, those domains host phishing pages or malware, ready to receive any traffic an AI tool sends toward the invented address.
- Unit 42 has coined the term ‘phantom squatting’ to describe this emerging threat pattern.
- The technique is already occurring in the wild, not merely theoretical.
What the technique involves
When a large language model generates a response that includes a web address — whether recommending a library, a tool, or a reference — it sometimes invents a domain that sounds credible but does not actually exist. This is a well-documented form of hallucination. Phantom squatting takes that failure mode and weaponises it: an attacker identifies domains that AI models commonly fabricate, registers them, and waits.
How attackers exploit the gap
Once a phantom domain is registered and under attacker control, it can be used to host phishing pages or deliver malware. Any user or automated process that acts on an AI-generated link — clicking it directly, or having a tool fetch it in the background — arrives at content the attacker controls rather than a harmless error page. The victim’s journey from AI prompt to malicious site can be entirely seamless, with no obvious warning that anything has gone wrong.
Unit 42 confirms real-world activity
Palo Alto Networks’ Unit 42 is the source of both the naming and the research. Their findings indicate phantom squatting is not a laboratory hypothesis; it is happening now. The research does not, based on available source material, detail the specific volume of confirmed incidents or the precise categories of malware observed, but the characterisation of the threat as occurring ‘in the wild’ is explicit.
Why LLM hallucinations are a structural problem here
The underlying issue is that language models generate plausible text rather than verified facts. A fabricated domain name looks correct in the context of a response — the right structure, the right style, often referencing a real organisation or product. Users and downstream systems have no built-in mechanism to distinguish a real URL from a hallucinated one without independently checking. Attackers are exploiting exactly that gap.
The broader supply-chain dimension
Organisations are increasingly embedding AI assistants and AI-powered coding or research tools into internal workflows. If those tools generate phantom domains as part of their output — in code snippets, dependency references, documentation, or recommendations — and staff or automated pipelines act on that output without verification, the attack surface grows quietly. It is not limited to individual users pasting AI responses into a browser.
Why it matters
For CISOs, phantom squatting introduces a risk vector that sits at the intersection of two trends already on most security agendas: the rapid adoption of AI tools across business functions, and the persistent threat of phishing and malware delivery via credential or URL abuse. The concern is structural rather than incidental. As AI tools become embedded in workflows — developer environments, research assistants, customer-facing chatbots — the frequency with which fabricated URLs are generated and acted upon will increase. Organisations do not yet have mature controls around validating AI-generated content before it is trusted or executed. That gap is what phantom squatting exploits. Security teams should treat AI-generated URLs with the same scepticism they apply to URLs in unsolicited email, and governance frameworks for AI tool use should reflect this.
What to do now
- Treat any URL produced by an AI tool as unverified until independently confirmed through a reliable source — do not assume AI-generated links are legitimate.
- Educate staff who use AI assistants that hallucinated web addresses are a documented risk, and that clicking AI-generated links without verification carries real phishing and malware exposure.
- Review internal workflows and automated pipelines that consume AI output, particularly those that may fetch or execute URLs generated by language models without a human verification step.
- Monitor for registrations of domains closely associated with your organisation’s name, products, or services that could plausibly be fabricated by AI tools referencing your brand.
- Include phantom squatting and AI-generated URL risks in threat modelling exercises, particularly for teams using AI coding assistants or research tools that produce references and links.
