On 3 July 2026, The Hacker News reported research from Palo Alto Networks Unit 42 introducing a threat technique that had been quietly documented in academic circles but had not yet received broad practitioner attention: phantom squatting. The concept is unsettling in its simplicity. Large language models, when asked about organisations, products, or services, frequently invent domain names that look authoritative but point to addresses that have never been registered. Attackers who know this behaviour exists can query AI models deliberately to harvest these hallucinated domains, register them before any defender notices, and weaponise them for phishing campaigns, malware delivery, or brand fraud.
Unit 42 ran a systematic analysis of the phenomenon across 913 global brands, using 685,339 adversarial prompts against two LLM families and generating 2.1 million URLs in the process. Of those URLs, 809,455 pointed to domains that did not exist. Among those non-existent domains, 13,229 had already been independently identified as malicious by threat intelligence feeds, meaning that attackers had already independently discovered and registered those hallucinated domains. Approximately 250,000 of the remaining hallucinated domains were unregistered and available for immediate registration at the time of the study. Each one represents a domain that a major AI model will invent when asked about a real brand, ready to be claimed by whoever gets there first.
When a large language model generates a URL for an organisation, it is constructing a plausible string based on patterns in its training data, not retrieving a verified web address. The model has learned that organisations in certain industries tend to use specific URL patterns: that financial institutions often have domains like payments.bankname.com or accounts.bankname.co.uk, that logistics companies use tracking subdomains, that e-commerce platforms have regional variants. The model applies these patterns to generate what it predicts a reasonable URL would be, without any mechanism to check whether that URL actually resolves.
The result is that LLMs produce hallucinated domains with a consistent structure: they look exactly like the kind of domain the real organisation would plausibly register, often matching the organisation's naming conventions and the top-level domain common in its industry and geography. This plausibility is precisely what makes them dangerous when registered and weaponised. A user who follows a link to accounts.targetbank-payments.com in a phishing email is far more likely to trust it than a link to an obvious gibberish domain, because the hallucinated domain looks like the kind of address the bank would actually use.
The predictability of LLM hallucination patterns also means that the domain space of likely hallucinations for any specific brand is enumerable. Unit 42's approach of running systematic adversarial prompts against specific brands produced a finite list of the domains that AI models are most likely to generate for each brand. That list can then be used proactively: registering the most plausible hallucinated domains defensively before attackers get there, and monitoring for registration of any domain on the list.
The most striking concrete example in Unit 42's research is the case they observed on 8 March 2026. On that date, Unit 42's monitoring system identified that two separate LLM families were consistently hallucinating a specific domain whenever prompted about a national postal service's online marketplace. The hallucinated domain was generated at every temperature setting tested, meaning it was not a rare low-probability output but a high-confidence prediction that both models agreed on. Unit 42 flagged the domain as a future phishing risk.
Twenty-three days later, on 31 March 2026, an attacker registered exactly that domain. They deployed a phishing kit named Montana Empire that cloned the real postal service storefront in real time, pulling the actual content from the genuine website and presenting it to victims while intercepting their payment details, bank-transfer information, and national identity documents. The kit was functional and convincing because it was not a static copy of the site but a live proxy that showed the real site's content while stealing the user's input.
The window between Unit 42's detection and the attacker's registration was 23 days. That window represents the opportunity for defensive action: registration of the hallucinated domain by the brand owner, or at minimum a monitoring alert that would have flagged the registration the moment it occurred and allowed rapid takedown action before the phishing kit had operated for any significant period. The alternative, discovering the fraudulent domain only after victims begin reporting losses, is the default outcome without proactive brand monitoring.
Traditional brand monitoring approaches look for variations on a known domain: typosquatting variants that swap letters or add hyphens, homograph attacks that use visually similar Unicode characters, and combosquatting that appends words to the brand name. These approaches all start from the real domain and enumerate likely deceptive variations. They work well against attackers who are constructing fraudulent domains manually based on the brand's actual web presence.
Phantom squatting produces domains that these approaches miss, because the hallucinated domain may not be a variation of the real domain at all. It is a plausible-looking but entirely invented URL that a language model generated based on training data patterns. The brand owner may never have used the pattern that the hallucinated domain represents, which means it would not appear in any enumeration of known legitimate variations. A monitoring system that only checks for variations on realcompany.com will not flag realcompany-customer-portal.net unless it generates that specific variant in its enumeration, and it has no reason to do so if the brand has never used that pattern.
Catching phantom squatting requires starting from the hallucination space rather than the real domain space. That means probing the AI models themselves to discover what they tend to invent for a specific brand, and then monitoring for registrations within that space. This is a fundamentally different approach from traditional domain monitoring, and it requires either running systematic LLM queries against your own brand or subscribing to a threat intelligence service that does this at scale. Understanding your external exposure now includes understanding what domains AI models are inventing in your name.
Phantom squatting extends beyond web phishing to software supply chains. The same USENIX study referenced in Unit 42's research found that code-generating AI models routinely suggest package names that do not exist in standard repositories. Developers using AI coding assistants who accept suggested import statements without verifying that the package exists are creating a dependency on a hallucinated package name. Attackers who monitor for these hallucinated package names, then publish a malicious package under that name in the relevant repository, have a delivery mechanism that reaches every developer who follows the AI's suggestion.
The PhantomRaven campaign documented in the research turned exactly this behaviour into a malware delivery channel: 126 npm packages with names matching LLM hallucinations, accumulating more than 86,000 installs before detection. The developers who installed them were not making a careless mistake; they were following the recommendation of an AI coding assistant that had suggested a package it had invented. The package existed in the registry because an attacker had registered it there, waiting for exactly this moment.
The phantom squatting research has practical implications for how organisations should approach brand monitoring in 2026 and beyond. A monitoring programme that only covers the organisation's own domain variations is now incomplete. As LLM usage grows and more users rely on AI assistants for navigation, product discovery, and code, the domains that those models invent for your brand become part of your effective attack surface even though you never registered them and may not know they exist.
Defensive registration of the highest-confidence hallucinated domains, identified by systematically probing AI models against your own brand, is the most direct control. For large brands with extensive web presence and many product lines, the hallucination space may be too large for complete defensive registration, making continuous monitoring and rapid takedown capability the practical alternative. The Unit 42 research suggests that a 23-day window between detection and attacker registration is typical in the cases they observed, which means that monitoring with a rapid response capability is viable as a complement to defensive registration for the highest-risk variants.
The connection to dark web and threat intelligence monitoring is direct: hallucinated domains that have been weaponised appear in phishing kit archives, in criminal forum discussions about target selection, and in infostealer logs when victims are redirected through them. Monitoring those channels provides an additional layer of detection for phantom squatting activity after registration, particularly for organisations whose brand presence is broad enough that systematic pre-registration is not feasible. A complete external monitoring posture now needs to include the AI hallucination space as part of its scope.
The phantom squatting research from Unit 42 explicitly extends beyond web domain impersonation to the software supply chain. When developers use AI coding assistants to write code, those assistants frequently suggest import statements for packages that do not exist in the relevant registry. The developer who accepts the suggestion without verifying that the package exists, installs it, and incorporates it into their codebase is creating a dependency on a hallucinated package name. An attacker who monitors for these hallucinated package names and publishes a malicious package under that name in the npm, PyPI, or other relevant repository has a delivery channel that reaches every developer who follows the AI's recommendation.
This is not theoretical. The PhantomRaven campaign documented in the Unit 42 research produced 126 npm packages with names that matched patterns frequently hallucinated by popular coding assistants. Those packages accumulated more than 86,000 installs before detection, meaning that 86,000 developers or development environments executed malicious code that arrived via a package recommended by an AI tool they trusted. The packages themselves contained credential-stealing functionality: they extracted environment variables, configuration files, and local credential stores from the development machine and exfiltrated them to the attacker's infrastructure.
For organisations that use AI coding assistants in their development workflows, the supply chain dimension of phantom squatting requires specific controls. Package installation should require verification against an approved list or a fresh resolution against the official registry before installation, not just acceptance of whatever package name the AI suggested. Development machines that execute AI-suggested code automatically, for example through IDE extensions that install suggested packages with a single click, should have their package management audited for unverified installs. The principle that code from an AI suggestion deserves the same scrutiny as code from any other untrusted source needs to be operationalised, not just stated.
The practical steps for an organisation that wants to address phantom squatting risk for its own brand begin with enumeration. Running systematic queries against major LLM families, specifically asking about your organisation's products, services, support resources, login portals, and partner sites, produces a list of URLs that those models tend to generate. The queries should be varied across temperature settings and prompt formulations to capture the full range of high-confidence hallucinations. This enumeration is a one-time exercise that needs refreshing periodically as the organisation's product landscape and the models' training data change.
From the enumerated list, defensive registration of the highest-confidence and most plausible hallucinated domains provides the most direct protection. A domain that both major LLM families generate consistently, that fits the organisation's naming conventions, and that uses a relevant top-level domain should be considered for defensive registration regardless of whether the organisation has any current plans to use it. The cost of registering and parking a domain is trivial compared to the cost of a phishing campaign that runs on it for even a few days.
For the long tail of hallucinated domains that the organisation cannot economically register defensively, continuous monitoring for new domain registrations within the enumerated list is the second line of defence. Certificate Transparency monitoring and registration feed monitoring can surface newly registered domains within hours of their creation, providing a detection window before the domain is activated for phishing. Combining phantom squatting monitoring with traditional brand monitoring, which watches for typosquats and combosquats of known domains, gives more complete coverage of the full space of domain-based brand impersonation in the AI era.
The Unit 42 research emphasises a point that has implications for how organisations approach brand monitoring going forward: LLM hallucination patterns change over time as models are retrained and fine-tuned. A domain that both major LLM families consistently hallucinated in early 2026 may be generated less frequently after a retraining cycle that corrects factual errors in the model's knowledge of the brand. Conversely, new hallucinations may emerge for brands that launch new products or services, as the models incorporate new information that they then embellish into plausible-looking but fictitious URLs.
This means that the enumeration of a brand's hallucination space is not a one-time exercise but a continuous practice. Organisations that set up phantom squatting monitoring need to re-probe the major LLM families against their brand on a regular cadence, quarterly at minimum, to capture changes in the hallucination patterns and update their monitoring lists accordingly. This is analogous to how traditional brand monitoring needs periodic updates to account for new product launches and new naming conventions that create new typosquatting target surfaces.
One of the most important aspects of the Unit 42 research is the 23-day gap it documented between their prediction of the hallucinated postal service domain and the attacker's registration. That 23-day figure represents the detection window in a case where an active monitoring programme was already in place. For organisations without phantom squatting monitoring, the first signal of a hallucinated domain being weaponised is typically a victim report or an external threat intelligence alert, which arrives after the phishing kit has been running and after losses have occurred.
The speed advantage that phantom squatting gives attackers relative to defenders is structural. LLMs are widely accessible, and any attacker can run systematic queries against them to harvest hallucinated domains for brands they intend to target. The enumeration step is fast and cheap. Domain registration is fast and cheap. Phishing kit deployment on a registered domain is fast once the attacker has an established template. The total time from the decision to target a brand to an active phishing site on a convincing hallucinated domain can be under an hour for an experienced operator.
Against this attack timeline, traditional brand monitoring that checks for new registrations on a daily batch basis produces alerts that arrive 24 hours or more after the attacker has already deployed their kit. Certificate Transparency monitoring, which produces alerts within minutes of a certificate being issued, is faster than registration-based monitoring but still arrives after the domain has been registered. The fastest available signal is monitoring of the hallucination space itself: knowing which domains the models are likely to generate for your brand before any attacker has registered them, and getting an alert the moment any of those domains appear in a new registration feed. That is the detection architecture that the Unit 42 research suggests is necessary to be genuinely ahead of phantom squatting attacks rather than reacting to them after they have already found victims.
Building that architecture requires two components that most organisations do not currently have: a systematic process for probing LLMs with your brand as the subject and cataloguing the domains they generate, and a monitoring subscription that watches new domain registration feeds for matches against that catalogue. Neither component is technically complex, but both require deliberate investment and ongoing maintenance as AI models are updated and as your brand's product portfolio evolves. Organisations that treat phantom squatting monitoring as an optional enhancement to existing brand monitoring will discover its necessity when the first hallucinated domain is weaponised against their customers.
The threats in this article share a common thread: they all depend on information that surfaces outside your perimeter before you have a chance to act on it. Infostealer logs containing your employees' session tokens appear on criminal markets within days of infection. Fraudulent domains imitating your brand go live before any internal team notices. Shadow IT assets sit exposed on the open internet because no one is looking outward from the right angle. And credential records from previous breaches circulate indefinitely, feeding the next wave of opportunistic attacks.
Defendis monitors dark web forums, criminal marketplaces, and breach data sources continuously for credentials, session tokens, and data linked to your organisation's domains. It surfaces fraudulent domains impersonating your brand before they become active phishing infrastructure. And it provides external visibility into your attack surface that complements what your internal tools see.
Book a demo to see how Defendis approaches dark web monitoring, brand protection, and external threat intelligence for enterprise security teams.
