Malware

Montana Empire

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

6 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

A standout case reveals an attacker who leveraged an AI coding assistant to build a full phishing kit named Montana Empire.

Stealth

1 technique

T1036MasqueradingEvidence1

an adversary registered the domain and deployed a weaponized phishing kit impersonating a legitimate marketplace.

Credential Access

1 technique

T1056Input CaptureEvidence1

Phishing artifacts (16.2%) encompass credential harvesting portals and brand-impersonation sites targeting the global organizations in our analysis.

Collection

2 techniques

T1056Input CaptureEvidence1

Phishing artifacts (16.2%) encompass credential harvesting portals and brand-impersonation sites targeting the global organizations in our analysis.

T1213Data from Information RepositoriesEvidence1

Harvesting of national identity document data alongside payment credentials

Command and Control

1 technique

T1071Application Layer ProtocolEvidence1

Of significant concern, command-and-control (C2) infrastructure accounts for 3.0% of identified URLs.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

Telemetry from the session logs confirmed the adversary leveraged the assistant to scrape legitimate storefronts, engineer the PHP backend and develop a Telegram-based C2 interface for real-time credential exfiltration.

INDICATORS OF COMPROMISE

IOCs tracked for this family

1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Hashes

1 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

palo alto networks unit 42 blogNews

Jul 1, 2026

Phantom Squatting: AI-Hallucinated Domains as a Software Supply Chain Vector

AI-assisted phishing kit used to impersonate a national postal service e-commerce marketplace, scrape live storefront content, harvest payment and identity data, and exfiltrate credentials via a Telegram-based operator panel/C2 interface.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching1

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping6

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.