Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector

Palo Alto Unit 42 researchers have identified a new supply chain threat: "phantom squatting," where large language models (LLMs) hallucinate web domains that adversaries can then register to intercept traffic generated by AI systems. This tactic, demonstrated by an attacker using an AI coding assistant to build a phishing kit, highlights the increasing risk posed by LLMs within the software development lifecycle and the potential for attackers to exploit trust in LLM-generated URLs. The research uncovered over 13,000 malicious URLs and estimates of 250,000 unregistered hallucinated domains.