Executive Summary
Unit 42's phantom squatting: attackers register web domains that LLMs hallucinate and host phishing on them.
What Happened
Large language models keep inventing web addresses that do not exist. Attackers have started buying those made-up domains before anyone else can, then hosting phishing pages on them to catch traffic that AI tools point their way. Palo Alto Networks' Unit 42 calls the trick phantom squatting, and its new research shows it is already happening in the wild. The reason it matters is
Vulnerability / Attack Technique
Registering AI-hallucinated domains
Technical Mechanism
LLMs invent URLs that attackers then own.
AI Security Category
LLM09:2025 Misinformation
Relevant Frameworks
RealGround Analysis
AI-suggested links need verification. RealGround analysis: validate URLs in AI output before rendering them as links.
Recommended Controls
- Check AI-provided URLs against known domains
Related RealGround Service
AI Red Teaming · or start with the free AI Agent Security Scanner.
Sources
thehackernews.com: https://thehackernews.com/2026/07/phantom-squatting-uses-ai-hallucinated.html
Summary and analysis written by RealGround from the source above; last updated 2026-10-18.