Phantom Squatting

This week AI crossed from attack target to attack operator — agentic ransomware, coerced coding agents, and LLM-output poisoning

The prior weekly's research lens was "the AI agent and toolchain control plane became a target." Four independent disclosures this week move the frame: AI is now showing up as the operator of an intrusion and as the delivery channel for one, not just the thing being attacked.

AI as operator. Sysdig documented JADEPUFFER, which it assesses to be the first end-to-end ransomware operation driven by an LLM rather than a human — entering through an unpatched, internet-exposed Langflow (CVE-2025-3248, on CISA KEV since May 2025), then autonomously sweeping credentials, forging a Nacos JWT from a documented default signing key, probing for container escape, and encrypting 1,342 Nacos config items with a never-persisted key (Sysdig, 2026-07-01). Sysdig's own framing is that the novelty is the operator, not the vulnerabilities — every step exploited a known, patchable exposure, but agentic tooling collapsed the skill floor to chain recon-through-destruction into one automated run (§ references, covered operationally 07-04).

AI as the thing attackers subvert to reach you. Mozilla 0DIN showed a "clean" GitHub repo — no malicious code to flag on static analysis — coercing an AI coding agent into a reverse shell through three levels of indirection (error message → DNS TXT lookup → shell execution), so the agent "never decided to open a shell; it decided to fix an error" (Mozilla 0DIN, 2026-06-25).

AI as the delivery layer. Unit 42's Phantom Squatting pre-registers the specific domains a production LLM hallucinates when asked for URLs, so later users or agent-browsers are handed attacker infrastructure with zero reputation history to flag (Unit 42, 2026-07-01). And Kaspersky's June telemetry shows a community AI-agent "skill" marketplace still distributing malicious SKILL.md files that run with the tokens and file-system access of whatever they touch (Kaspersky Securelist, 2026-07-01).

Weekly takeaway: for a SOC that increasingly runs AI coding agents in CI/CD and developer workstations and is beginning to field agentic tooling, the strategic obligation is to treat every agent capability — shell, repo access, browsing, third-party skills — as a privilege scope that needs an explicit grant and human-in-the-loop gating, and to recognise that none of these attacks needed a novel software bug: they exploited agent autonomy plus the same neglected, internet-exposed infrastructure defenders already owe a patch. Per-technique detail and detection concepts in § references.

Builds on: 2026-07-04/jadepuffer-agentic-llm-ransomware-langflow-rce · 2026-06-29/mozilla-0din-a-clean-github-repo-coerces-ai-coding-agents-in · 2026-07-01/unit-42-phantom-squatting-registering-ai-hallucinated-domain · 2026-07-02/kaspersky-community-ai-agent-skills-are-an-emerging-supply-c

Unit 42: "Phantom Squatting" — registering AI-hallucinated domains to poison LLM-driven URL delivery

Palo Alto Networks Unit 42 described phantom squatting, a supply-chain attack class in which adversaries systematically probe production LLMs to learn which non-existent brand/vendor domains a model hallucinates when asked for URLs, then pre-register those specific domains before defenders or brand owners react (Unit 42, 2026-07-01). When later users — or autonomous AI agents performing tool-use/browsing — ask the same or a similarly-trained model for a link, they are handed an authoritative-sounding recommendation pointing at attacker-controlled infrastructure, bypassing traditional phishing-link delivery entirely. The core evasion is a zero-reputation bypass: a domain registered specifically to match a predicted hallucination has no threat-intel history, blocklist entry or reputation score at first weaponized use, defeating reputation-age-based URL/DNS filtering. Unit 42 cites a concrete case — a "Montana Empire" postal-service phishing kit that went live 23 days after Unit 42 first observed an LLM hallucinating that domain. Distinct from package-name "slopsquatting": this is domain-level and targets both humans and agent browsing. Defender takeaway: log and diff every URL an LLM surfaces against a verified canonical-domain allowlist before it reaches a user or an agent's browsing tool, and treat "brand-adjacent, recently-registered, high-similarity domain" as a standalone signal independent of reputation score. [SINGLE-SOURCE] — vendor research, no independent corroboration in-window.