AI-assisted domain spoofing and cybersquatting used for impersonation scams and malware delivery

Threat actors are increasingly using cybersquatting (e.g., typosquatting, combosquatting, TLD squatting, and homograph domains) to impersonate legitimate brands and services for credential phishing, malware delivery, and fraud. Reporting cited WIPO handling a record ~6,200 domain disputes in 2025 (up 68% since 2020) and research indicating a sharp rise in malicious campaigns leveraging squatted domains, with the vast majority used to phish credentials or deliver malware; one example described impersonation of Decodo (formerly Smartproxy) via lookalike domains such as smartproxy.org and smartproxy.cn, which allegedly led to customer losses and reputational damage for the legitimate firm.

Separately, incident response research described an AI-assisted business impersonation operation that registered 150+ domains spoofing law firms, using multiple registrars and IP ranges, unique SSL/TLS certificates, and Cloudflare to conceal infrastructure. The operation appeared designed to target scam victims repeatedly (including reuse of a phone number tied to prior scam campaigns), and researchers warned that AI is lowering the barrier for less-skilled actors to run more convincing phishing/social engineering and fraud operations at higher scale.