Phantom Squatting: AI Hallucinations Fueling Malware and Phishing Attacks

Attackers are exploiting a technique called 'phantom squatting' to register non-existent domains generated by large language models (LLMs). These domains, which are plausible but do not exist, are used to host sophisticated phishing kits and deliver malware, particularly targeting Android systems. Research from Unit 42 indicates that adversaries are systematically probing LLMs to identify these hallucinated domains, which are then preemptively registered. The attack vector poses a significant risk to legitimate brands as users may be misled into visiting these malicious sites. The current status of this threat is active, with ongoing registrations of such domains noted. The implications for cybersecurity are profound, as this method could lead to widespread phishing attacks and malware distribution.

Key Points: • Phantom squatting involves registering AI-generated non-existent domains for malicious use. • Adversaries are using these domains to host phishing kits and malware targeting Android devices. • Research indicates a systematic approach to exploiting LLMs for domain generation.