Loading story…
Palo Alto Networks reported widespread abuse of cybersquatting domains that imitate major brands including Facebook, Apple, Amazon, Netflix, Microsoft, Samsung, Walmart, and Wells Fargo to conduct phishing, malware delivery, command-and-control, technical support fraud, reward scams, re-bill scams, and parked-domain monetization. In one month of observation, researchers identified 13,857 squatting domains—about 450 per day—with 2,595 classified as malicious and 5,104 as suspicious or high risk, showing how frequently newly registered lookalike domains are weaponized against consumers.
The activity used multiple squatting techniques, including typosquatting, combosquatting, homograph-squatting, soundsquatting, bitsquatting, and level-squatting, and often targeted profitable sectors such as search, social media, shopping, finance, and banking. Examples included secure-wellsfargo[.]org for phishing, samsungeblyaiphone[.]com for Azorult malware distribution, microsoft-store-drm-server[.]com for C2 activity, microsoft-alert[.]club for a technical support scam, and netflixbrazilcovid[.]com for a re-bill scam; researchers also found that more than half of the malicious or high-risk domains were not detected by any VirusTotal vendors during the comparison window, underscoring significant detection gaps and the need for continuous monitoring of newly registered domains and passive DNS data.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks reported detecting 13,857 squatting domains in December 2019, averaging about 450 per day. Of those, 2,595 were classified as malicious and 5,104 as suspicious or high risk.
The report states that Azorult, a credential and payment-card information stealer later distributed via a squatting domain, has been active since 2016.
On February 3, the same campaign used microsoft-sback-server[.]com, which shared infrastructure and SSL behavior with the earlier Microsoft-themed squatting domain.
The campaign then used microsoft-store-drm-server[.]com from January 31 to February 2; Palo Alto Networks linked malware samples communicating with this squatting domain.
The same short-lived command-and-control campaign moved to stt-box[.]com from January 29 to 31 as part of its rotating squatting-domain infrastructure.
A command-and-control campaign using squatting domains employed store-in-box[.]com from January 27 to 28 before rotating to other lookalike domains.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly using **cybersquatting** (e.g., typosquatting, combosquatting, TLD squatting, and homograph domains) to impersonate legitimate brands and services for **credential phishing**, **malware delivery**, and fraud. Reporting cited WIPO handling a record ~6,200 domain disputes in 2025 (up 68% since 2020) and research indicating a sharp rise in malicious campaigns leveraging squatted domains, with the vast majority used to phish credentials or deliver malware; one example described impersonation of Decodo (formerly Smartproxy) via lookalike domains such as `smartproxy.org` and `smartproxy.cn`, which allegedly led to customer losses and reputational damage for the legitimate firm. Separately, incident response research described an **AI-assisted business impersonation** operation that registered **150+ domains spoofing law firms**, using multiple registrars and IP ranges, unique SSL/TLS certificates, and **Cloudflare** to conceal infrastructure. The operation appeared designed to target scam victims repeatedly (including reuse of a phone number tied to prior scam campaigns), and researchers warned that AI is lowering the barrier for less-skilled actors to run more convincing phishing/social engineering and fraud operations at higher scale.
Jun 29, 2026
Infoblox Threat Intel reported that cybercriminals are increasingly exploiting expired "dropcatch" domains as a large-scale abuse channel, with roughly **65,000** re-registered dropped domains observed per day in the first half of 2026—about **20%** of newly seen domains. Because these domains retain backlinks, reputation, residual traffic, and sometimes dangling DNS relationships, attackers can revive them for scams, traffic monetization, malware delivery, and redirection without first compromising new infrastructure. Researchers said actors including **Stuffy Squirrel**, **Shady Squirrel**, and **Swiping Squirrel** collectively control thousands of such domains, using cloaked traffic distribution, ad-tech chains, affiliate programs, and custom injections to steer victims to tech-support scams, gambling offers, **SocGholish**, and other malicious content. The most prominent operation, **Sable Squirrel**, was described as a sprawling network controlling more than **10,000 domains** tied to illegal sports streaming, betting promotion, traffic redirection, and malware command-and-control, with estimated domain spending exceeding **$7 million**. Infoblox identified more than **31,000 malware samples** communicating with Sable Squirrel infrastructure, including **Quasar RAT**, **AsyncRAT**, **DCRat**, **NanoCore**, **Remcos**, **njRAT**, and samples with **HiddenTear** signatures, while some binaries carried the actor’s own brands such as `socolive`, `xoilac`, and `8xbet` in PE metadata. Researchers said the actor repurposed hundreds of streaming domains into dual-use malware infrastructure beginning in late 2025, likely overlapping with the Vietnamese **Xoi Lac TV** ecosystem, and that related actors have also redirected visitors from major media sites and partnered with downstream malware operators such as **TA569** after disruptions to earlier criminal infrastructure.
Aug 17, 2026
Palo Alto Networks Unit 42 reported an active supply-chain threat dubbed **phantom squatting**, in which large language models generate plausible but nonexistent brand-related domains that attackers later register and weaponize. In a study covering 913 global brands, 685,339 prompts across two LLM families produced 2.1 million URLs; researchers found 13,229 already classified as malicious and roughly 250,000 unregistered hallucinated domains that could be claimed by adversaries. The report says the technique creates a new path for phishing, malware delivery, and brand impersonation by exploiting domains that appear credible because they are syntactically consistent with legitimate organizations. Unit 42 said defenders observed multiple real-world cases in which hallucinated domains were identified **18 to 51 days** before attackers registered them, including a Montana Empire phishing operation and a postal-themed malicious Android APK campaign. The researchers warned that phantom-squatted domains can evade traditional reputation-based URL defenses because newly registered domains start with no threat history, while trusted AI assistants and autonomous agents may surface or use those domains directly, increasing software supply-chain and user-targeting risk.
Jul 22, 2026