Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector

Unit 42 published a batch of research and threat briefs highlighting an expanding set of high‑impact supply‑chain and cloud risks. Key themes: AI supply‑chain abuse (phantom squatting / LLM‑hallucinated domains, malicious skills in marketplaces like ClawHub, and integrity risks for agent skills), cloud namespace and bucket hijacking across CSPs (including a Vertex AI Python SDK bucket‑squatting issue leading to cross‑tenant RCE), large‑scale credential campaigns targeting security vendor devices, active exploitation of PAN‑OS (CVE‑2026‑0257), npm ecosystem supply‑chain evolution (wormable/mult