Tools & techniquesPublished July 7, 2026 · Updated July 8, 2026
OSINT Profile

Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector

OSINT profile compiled by Tenka Cloud Security. Techniques cross-referenced with MITRE ATT&CK.

The plain-English version

(The "I just walked in the door, explain it to me" cut.)

Imagine you ask a very confident robot for the name of a bakery. The robot doesn't actually know, so it makes one up: "Blue Duck Bakery." There is no Blue Duck Bakery. But a sneaky person keeps hearing the robot say it — so they open a real shop called Blue Duck Bakery and stock it with rotten bread. Now when you trust the robot and walk in, you get the bad bread. The robot never lied on purpose. It just guessed, and a bad guy was already standing where the guess landed.

For the support desk

(How to relay this to a customer or teammate who asks "why did my build get flagged?")

  • AI coding tools sometimes suggest packages or links that don't exist yet.

  • Attackers pre-register those exact names, so a previously-broken suggestion suddenly "works."

  • Installing or clicking it runs attacker-controlled code on the developer's machine or in the build.

  • Rule of thumb to hand the user: if an AI gave you the package name or URL, verify it exists and is trusted before you install or click. Never paste-and-run install commands blind.

    • How the attack works

  • Harvest the hallucinations. The attacker runs common prompts against popular AI assistants and records the non-existent package names and domains they confidently recommend.

  • Register the name. They acquire the matching domain (Acquire Infrastructure: Domains, T1583.001) or publish a package to a public registry under that exact name.

  • Stage the payload. Malicious code is uploaded and made to look legitimate — a plausible README, a real-looking version history (Stage Capabilities: Upload Malware, T1608.001; Masquerading, T1036).

  • Wait for trust. A developer copies AI output and runs the install or opens the link (User Execution, T1204), compromising the dependency chain (Compromise Software Dependencies and Development Tools, T1195.001).

    • MITRE ATT&CK mapping

  • T1195.001 — Compromise Software Dependencies and Development Tools

  • T1583.001 — Acquire Infrastructure: Domains

  • T1608.001 — Stage Capabilities: Upload Malware

  • T1204 — User Execution

  • T1036 — Masquerading

    • What Tenka Cloud does about it

    Every Tenka Cloud VM ships with a supply-chain guardrail baked into the on-box AI's default instructions. Before installing any dependency, the assistant is told to verify the package actually exists and is the one intended (registry page, download counts, repo), to never install a name just because it was suggested, and to treat every pip install / npm install as a trust decision. Because each VM runs the assistant with full privileges, this default narrows the window where a hallucinated package name turns into code execution.

    Recommended actions

  • Pin and lock all dependencies; install through a vetted internal registry or proxy rather than straight from public registries.

  • Enable install-time allowlisting and block newly-registered packages and domains by default.

  • Treat AI-suggested package names and URLs as untrusted input — verify existence, ownership, and reputation before use.

  • Cover slopsquatting explicitly in code review and developer onboarding.

    • Sources & references

    MITRE ATT&CK CISA

    Technique IDs map to MITRE ATT&CK; see also CISA guidance on software supply-chain security.

    Summary

    Phantom squatting — also called slopsquatting — is a software supply-chain attack that weaponises the mistakes AI coding assistants make. Large language models routinely hallucinate: they invent plausible-sounding names for software packages, libraries, and domains that do not actually exist. Attackers watch for the invented names that keep recurring, then register them for real — a malicious npm or PyPI package, or a look-alike domain. The next time a developer pastes AI-generated code and runs pip install <name>, or follows a suggested URL, they pull the attacker's payload instead of nothing.

    The attacker never has to break in. They simply wait at the address the AI keeps guessing, and let trust in the tool do the rest.

    ← Back to blog