New Security Research Identifies AI-Hallucinated Domains as Emerging Attack Vector for Machine Identity Infrastructure
TL;DR
- Hackers are registering AI-hallucinated domains to launch sophisticated phishing and supply chain attacks.
- Attackers monitor LLM outputs to claim plausible domains before security teams can secure them.
- AI coding assistants are inadvertently creating a direct pipeline for malicious infrastructure injection.
- Over 250,000 hallucinated domains remain unregistered, posing a massive threat to machine identities.
- Security teams have a narrow 18-51 day window to preemptively register these phantom domains.
Phantom Squatting: How AI Hallucinations Are Becoming a Hacker’s Best Friend
We’ve spent years teaching developers to watch out for typosquatting—those sneaky, misspelled URLs designed to catch a fat-fingered employee. But there’s a new, far more sophisticated threat on the horizon, and it’s being built by the very tools we trust to write our code. Enter "phantom squatting."
It’s a simple, terrifying premise: Large Language Models (LLMs) are prone to hallucinations. Sometimes, they invent URLs that look perfectly legitimate but don’t actually exist. Attackers have realized this, and they’re playing a long game. They monitor what these models spit out, wait for a plausible-looking "hallucination," and then register those domains before anyone else can. Once they own the domain, they’re in a prime position to intercept traffic, launch phishing campaigns, or inject malicious payloads directly into your software supply chain.
The Mechanics of the Mirage
The research, pulled together by the team at Unit 42 by Palo Alto Networks, paints a sobering picture. They ran an exhaustive analysis on 913 global brands, processing over 685,000 URL queries and generating a staggering 2.1 million potential web addresses. The result? Over 13,000 confirmed malicious domains are already active. Worse, there are roughly 250,000 hallucinated domains sitting out there, unregistered and waiting for a bad actor to claim them.
It’s not an immediate strike. Attackers are patient. Data shows they typically register these phantom domains anywhere from 18 to 51 days after the AI first conjures them. That’s your window. It’s a narrow, frantic sliver of time, but it’s the only chance security teams have to lock these domains down before they become weapons.
When Your Coding Assistant Turns Against You
The real danger here isn't just that these domains exist—it’s how they get used. We’re embedding AI coding assistants into every corner of the software development lifecycle. These tools are supposed to be force multipliers, but they’re also creating a direct pipeline for attackers.
Take the "Montana Empire" phishing kit as a prime example. An attacker used an AI coding assistant to build the kit, specifically targeting a domain that researchers had flagged as a high-risk hallucination just 23 days earlier. The attacker wasn't just guessing; they were using the same AI models that developers use to refine their own infrastructure.
When a developer or an automated CI/CD agent follows a link suggested by an AI, they assume it’s safe. They aren't looking for a trap. But if that link leads to a domain an adversary has just registered, the game is over. You’re handing over API keys, proprietary source code, or machine identity credentials to someone waiting on the other side. Traditional security filters, which are often tuned to catch human-centric threats, struggle to flag these because the "origin" of the link is a trusted, high-level AI model.
Understanding the Risk
| Feature | Description |
|---|---|
| Primary Driver | AI-generated hallucinations of non-existent URLs. |
| Attack Surface | ~250,000 unregistered hallucinated domains identified. |
| Latency | Attackers register domains 18–51 days after hallucination. |
| Primary Impact | Traffic interception, phishing, and supply chain injection. |
If you’re worried about your own exposure, you can look into resources like the AI security assessment. Getting a handle on phantom squatting isn't just "nice to have"—if you’re running LLMs in your CI/CD pipelines, it’s a prerequisite for basic security.
How to Fight Back
You can’t stop an LLM from hallucinating, but you can stop those hallucinations from becoming your company’s undoing. The old perimeter-based security models are effectively dead when the threat is coming from inside the code itself.
Here is how to tighten the screws:
- Watch the AI’s Output: Start monitoring your brand-related terms in AI-generated output. If the AI is suggesting URLs, someone on your team needs to be vetting them before they hit your production environment.
- Use Specialized Runtime Security: Tools like Prisma AI Runtime Security can help give you visibility into how your models are actually interacting with the outside world.
- Trust, but Verify: It sounds like basic advice, but it’s critical: developers and automated agents should be trained (or programmed) to verify the reputation of every URL an AI suggests. If it looks like a phantom, treat it like a ghost.
- Know Your Perimeter: Keep a strict, updated inventory of your legitimate domains. If you know exactly what you own, it becomes much easier to spot the "phantom" domains trying to masquerade as your infrastructure.
The bottom line? The line between helpful AI guidance and malicious redirection is blurring. We’ve entered an era where the "hallucination factor" has to be a standard part of your threat modeling. These models are powerful, but they’re also unpredictable. As attackers get better at weaponizing that unpredictability, security professionals need to stop thinking of AI as a black box and start treating it as a potential entry point for the next big breach. The window to secure your supply chain is closing—don't wait until the phantom becomes a reality.
