Unit 42 Uncovers 'Phantom Squatting': A New Supply Chain Threat Vector Exploiting LLM-Hallucinated Domains

Executive Summary

Unit 42 has uncovered a novel and active software supply chain attack vector termed 'Phantom Squatting.' This threat leverages the tendency of Large Language Models (LLMs) to hallucinate non-existent web domains, which adversaries then register to intercept traffic and compromise users. Our research confirms that this is not a theoretical risk but an ongoing attack pattern observed in the wild. Attackers are weaponizing AI-generated misinformation to bypass traditional security measures that rely on historical reputation data. A key finding includes the discovery of a phishing kit named Montana Empire, which was deployed on a phantom domain predicted by our systems weeks in advance. With over 250,000 unregistered phantom domains discovered, the attack surface is vast and growing. This report details the phantom squatting lifecycle, assesses its impact on the software supply chain, and provides actionable recommendations for detection and mitigation.

Threat Overview

Phantom squatting represents a significant evolution in supply chain attacks, shifting the focus from traditional artifacts like tampered packages to the very fabric of AI-assisted development. As LLMs become integrated into developer workflows and CI/CD pipelines, they are treated as trusted sources of information. Developers and automated systems often accept LLM-generated output, including URLs for documentation, API endpoints, and service configurations, without verification.

This trust creates a critical vulnerability. When an LLM hallucinates a domain—for example, suggesting api.build-notifier.io for a CI/CD webhook—it may be entirely fictitious. An adversary who has proactively registered this domain can intercept sensitive data, such as build telemetry or secrets. The core of the threat lies in this 'zero-reputation bypass.' A phantom domain, at the moment of its weaponization, has no negative history, is not on any blocklist, and its content is newly generated, rendering conventional threat intelligence and reputation scoring ineffective. The LLM, in effect, becomes an unwitting accomplice, laundering the reputation of a malicious domain by presenting it as authoritative.

Technical Analysis

The phantom squatting attack lifecycle consists of four primary phases:

1. Adversarial Hallucination Probing: Attackers systematically query LLMs with various prompts related to a target brand or its software. The goal is to map the 'hallucination surface'—the set of phantom domains the model is likely to generate.
2. Preemptive Registration: Armed with a list of potential phantom domains, the adversary registers the most promising ones. The low cost and ease of registering generic top-level domains (gTLDs) make this highly scalable.
3. Weaponization: The newly registered domain is configured with malicious content. This could be a phishing page mimicking a legitimate login portal, a server to intercept API calls and secrets, or a host for drive-by downloads.
4. Interception: An unsuspecting developer or an automated CI/CD process queries an LLM. The LLM provides a link or endpoint pointing to the phantom domain. The user or system trusts the output and connects, triggering the attack.

This attack pattern leverages several MITRE ATT&CK techniques:

• Reconnaissance:
  • T1589.002 - Gather Victim Organization Information: Software: Adversaries probe LLMs to discover what phantom domains are associated with a target organization's software and services.
• Resource Development:
  • T1583.001 - Acquire Infrastructure: Domains: The core of the attack involves registering the hallucinated domains.
  • T1608 - Stage Capabilities: Setting up the malicious infrastructure (phishing sites, data interception servers) on the phantom domains.
  • T1588.006 - Obtain Capabilities: Web Services: The case of the Montana Empire phishing kit shows attackers using AI coding assistants to build their malicious tools, demonstrating a full AI-driven attack cycle.
• Initial Access:
  • T1566.002 - Phishing: Spearphishing Link: The LLM acts as the delivery mechanism for the malicious link, lending it an air of legitimacy that traditional phishing emails lack.
• Execution:
  • T1204.002 - User Execution: Malicious Link: The end-user or automated system clicks the link or executes the HTTP request provided by the trusted LLM.

Impact Assessment

The impact of phantom squatting on an organization can be severe, extending deep into the software supply chain.

• Credential and Secret Theft: Developers interacting with phantom domains may submit credentials to fake login portals. CI/CD pipelines could send API keys, tokens, and other secrets to adversary-controlled endpoints.
• Malware Distribution: Phantom domains can be used to host malicious software dependencies, tampered binaries, or drive-by downloads, infecting developer machines and build environments.
• Data Exfiltration: Intercepted build telemetry can expose sensitive information about an organization's internal infrastructure, source code, and development practices.
• Reputation Damage: A successful attack originating from an organization's AI-assisted tools can erode trust among customers and partners.

The scale of the problem is significant. Unit 42's analysis of 913 global brands across two LLM models generated 2.1 million URLs, revealing over 13,229 confirmed malicious URLs and approximately 250,000 unregistered (and thus exploitable) phantom domains.

IOCs — Directly from Articles

The source article discusses the discovery of over 13,229 malicious URLs but does not provide a specific list of Indicators of Compromise (IOCs).

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns, which could indicate related activity:

Detection & Response

Detecting and responding to phantom squatting requires a shift away from purely reputation-based defenses.

• Proactive Domain Monitoring: Organizations should use tools to predict and monitor for the registration of likely phantom domains related to their brands. This allows for early warning before an attack is launched.
• Network Traffic Analysis (D3-NTA): Implement strict egress filtering and anomaly detection for traffic originating from developer workstations and CI/CD runners. Baseline normal activity and alert on connections to new, uncategorized, or low-reputation domains.
• URL Analysis (D3-UA): Employ advanced URL filtering solutions that can analyze domain age, registration data, and other metadata in real-time to block access to nascent malicious sites.
• Developer Education: Train developers on the risks of LLM hallucinations and establish policies for verifying all externally sourced URLs and code snippets, regardless of their origin.
• Incident Response Playbook: Develop a specific playbook for incidents involving potential phantom squatting, focusing on identifying the source of the malicious URL (i.e., which LLM prompt) and assessing the scope of potential data exposure.

Mitigation

Mitigating phantom squatting requires a multi-layered approach that combines proactive measures with robust technical controls.

1. Defensive Domain Registration: Proactively identify and register likely phantom domains associated with your brand before adversaries can. This is the most effective way to neutralize the threat for a specific domain.
2. Outbound Traffic Filtering (D3-OTF): Implement strict egress policies on developer endpoints and CI/CD systems. Use a default-deny posture, only allowing connections to a pre-approved list of domains and IP addresses.
3. AI Security Posture Management (ASPM): Deploy solutions designed to secure the AI pipeline itself. These tools can act as an intermediary to vet LLM output, scan for malicious URLs, and enforce security policies before a developer or system consumes the AI-generated content.
4. Harden the Development Environment: Use application allowlisting to restrict the tools and scripts that can run in build environments. This can prevent the execution of malware downloaded from a phantom domain.
5. User Training (M1017): Conduct regular training sessions to make developers aware of this threat vector. Encourage a culture of skepticism and verification for all AI-generated content.