Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector

Researchers discovered that large language models (LLMs, AI systems trained on massive amounts of text data) frequently generate fake web domain names that don't actually exist but sound like they belong to real companies. Attackers are registering these made-up domains (a practice called phantom squatting) to intercept traffic sent by AI systems and users who trust the LLM's output, creating a new supply chain attack vector (a way to compromise software development and deployment). The researchers identified over 13,000 confirmed malicious URLs and approximately 250,000 unregistered hallucinated domains that attackers could exploit.