Phantom Squatting Uses AI-Hallucinated Domains for Phishing and Malware

Large language models keep inventing web addresses that do not exist. Attackers have started buying those made-up domains before anyone else can, then hosting phishing pages on them to catch traffic that AI tools point their way. Palo Alto Networks' Unit 42 calls the trick phantom squatting, and its new research shows it is already happening in the wild. The reason it matters is

Palo Alto Networks Unit 42 reports that attackers are exploiting AI-hallucinated domains through “phantom squatting,” registering fake URLs that language models invent and then using them for phishing and malware delivery. The research found 2.1 million AI-generated URLs across tested brands, with about 250,000 unowned hallucinated domains and real-world detections occurring weeks before adversary registration. CyberSE.AI analysis: this is a high-risk malicious AI use pattern because it turns model output into an attack surface, especially where users or autonomous agents trust AI-generated links without verification.