Unit 42 uncovered over 13,000 malicious URLs created by registering fake domains that large language models often hallucinate. These domains mimic real ones with patterns like name_download.com instead of.

This tactic, called Phantom Squatting, works like typosquatting but uses AI-generated fake URLs. The LLMs themselves suggest these phishing sites to users, removing the need for hackers to lure victims directly.