Unit 42 Details Phantom Squatting Attacks Using LLM-Hallucinated Domains
Summary
Unit 42 says attackers are registering LLM-hallucinated domains for phishing and malware delivery. Its research found 13,229 URLs flagged as malicious, about 250,000 unregistered phantom domains, and cases involving Montana Empire and a postal-service APK.
Key points
- Researchers tested 685,339 prompts across 913 brands and two LLM families, generating 2.1 million URLs.
- Threat-intelligence systems flagged 13,229 URLs as malicious; 41,313 more were categorized as high risk.
- The study found 809,455 URLs resolving to non-existent domains, representing about 250,000 unique phantom domains.
- Unit 42 says attackers can register hallucinated domains and deploy malicious content before reputation-based defenses identify them.
- In the Montana Empire case, researchers linked an AI coding assistant to development of a phishing kit with a PHP backend, credential capture, and Telegram-based control.
- A separate case used a fake postal-service site to deliver a malicious Android APK; Unit 42 detected the domain 51 days before registration.
- Unit 42's framework monitors hallucinated domains and registration events, providing advance warning before some domains are weaponized.
Article Details
- Attack Vectors
- Attackers probe LLMs for plausible brand-related domains, register hallucinated domains, and deploy malicious content before the domains build a reputation.
- LLM-generated URL recommendations can direct users or autonomous agents to attacker-controlled infrastructure, including cloned phishing sites used to capture credentials and payment information.
- The Montana Empire phishing kit used a real-time storefront scraper, a PHP backend, Telegram-based credential exfiltration, and manual OTP relay.
- A fraudulent postal-service landing page impersonated the service and delivered a malicious Android APK.
- Reported cases also included cloned sports-betting sites targeting Bangladesh and a bank-themed site used to steal corporate IT credentials.
- Defensive Notes
- Map likely LLM-generated domains in advance, maintain a phantom-domain watchlist, and monitor domain-registration events for matches.
- Recheck newly registered watchlisted domains using ownership and content signals; block domains determined to be malicious and continue monitoring high-risk cases.
- The article says Advanced URL Filtering and Advanced DNS Security identify known malicious domains and URLs associated with this activity, and that Advanced WildFire models and analysis techniques were reviewed and updated.
- The article identifies Prisma AIRS and Koi Agentic Endpoint Security as products that can help secure LLM-powered agentic workflows and manage AI artifacts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 2202a30daad9928ef47cca5f4ab04ce083692a94428e386fa01c2dd44557e34b | SHA-256 of the malicious Android APK delivered from a fraudulent postal-service landing page. |
| SHA256 | eb07edaa2786cfddfa4c15526168f2200d85300aee0a8f253b32d2462a7b0bcd | SHA-256 of the Montana Empire phishing-kit ZIP archive identified in the article. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe Montana Empire kit used a Telegram-based C2 interface for real-time credential exfiltration.T1056.003 · Web Portal CaptureThe Montana Empire kit used cloned web pages and credential-harvesting portals to capture victim credentials.T1105 · Ingress Tool TransferA fraudulent postal-service site induced victims to download a malicious Android APK.T1111 · Multi-Factor Authentication InterceptionThe Montana Empire operator panel supported manual OTP relay and management of victim OTP approvals.T1204.001 · Malicious LinkThe article describes victims following an LLM's recommendation to visit an attacker-controlled URL.T1583.001 · DomainsAttackers registered hallucinated domains and deployed malicious content on them, including domains impersonating postal services.
Vendors
Products
Advanced DNS SecurityAdvanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.Advanced URL FilteringAdvanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.Advanced WildFireThe Advanced WildFire machine-learning models and analysis techniques have been reviewed and updated in light of the indicators shared in this research.Koi Agentic Endpoint SecurityKoi Agentic Endpoint Security is designed to help discover every AI artifact across the agentic endpoint, assess its risk, enforce prevention & runtime controls, and remediate violations.Prisma AIRSPrisma AIRS can help secure organizations deploying LLM-powered agentic workflows.Telegram[T1090 ] Proxy: External Proxy – Telegram-based C2 and relays are used for attacker control and forwarding victim data (‘a Telegram-based C2 interface for real-time credential exfiltration’).
Tools
Countries
Industries
E-commerceImpersonation of a postal service’s e-commerce marketplace in a phishing campaign using the Montana Empire phishing kitTechnologyLLM1: A production-optimized, mini-class variant of an enterprise LLM from a major technology provider (released April 2025), engineered for high-volume, cost-efficient deployment.