Loading story…
Threat actors are increasingly using cybersquatting (e.g., typosquatting, combosquatting, TLD squatting, and homograph domains) to impersonate legitimate brands and services for credential phishing, malware delivery, and fraud. Reporting cited WIPO handling a record ~6,200 domain disputes in 2025 (up 68% since 2020) and research indicating a sharp rise in malicious campaigns leveraging squatted domains, with the vast majority used to phish credentials or deliver malware; one example described impersonation of Decodo (formerly Smartproxy) via lookalike domains such as smartproxy.org and smartproxy.cn, which allegedly led to customer losses and reputational damage for the legitimate firm.
Separately, incident response research described an AI-assisted business impersonation operation that registered 150+ domains spoofing law firms, using multiple registrars and IP ranges, unique SSL/TLS certificates, and Cloudflare to conceal infrastructure. The operation appeared designed to target scam victims repeatedly (including reuse of a phone number tied to prior scam campaigns), and researchers warned that AI is lowering the barrier for less-skilled actors to run more convincing phishing/social engineering and fraud operations at higher scale.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A case study described Decodo, formerly Smartproxy, being impersonated through domains including smartproxy.org and smartproxy.cn, allegedly by actors in China. The spoofed domains reportedly caused customer losses and reputational damage.
Sygnia reported an AI-assisted business impersonation scam using more than 150 domains spoofing law firms. The infrastructure used multiple registrars, distinct IP ranges, unique SSL/TLS certificates, and Cloudflare concealment, with signs it repeatedly targeted prior scam victims.
The World Intellectual Property Organization handled 6,200 domain disputes in 2025, reflecting a 68% increase since 2020. The figure illustrates the growing scale of domain abuse and brand impersonation activity.
SecPod reported a 19-fold increase in malicious cybersquatting campaigns from late 2024 to mid-2025, with 99% of squatted domains used for phishing or malware delivery. The trend marked a major escalation in the use of lookalike domains for cybercrime.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are scaling **impersonation-driven fraud** by abusing trust signals—public figures, brands, and platform distribution—to lure victims into handing over money or sensitive information. One documented operation used **celebrity impersonation** tailored to Canadians, selecting locally relevant public figures and using **social media ad targeting** (e.g., geolocation and profile-based targeting) to constrain exposure to the intended country and increase conversion; the campaign also leveraged emotionally manipulative narratives (e.g., injury/misfortune) to accelerate engagement and reduce skepticism. In parallel, **domain-based impersonation (“digital squatting”)** has increased materially, with reporting citing a **68% rise** over five years and **WIPO** recording **6,200 domain disputes in 2025**. Common techniques include `typosquatting`, `combosquatting`, `TLD squatting`, and `homograph` attacks, which route users to phishing or fraudulent payment pages that mimic legitimate brands; the trend is also driving reputational harm when victims receive low-quality or nonexistent services. Recommended mitigations emphasized in reporting include proactively registering defensive domains across multiple TLDs and monitoring for lookalike domains to reduce brand impersonation risk.
Jun 29, 2026
A senior **U.S. Secret Service** official warned that weaknesses in the internet’s domain registration and governance model are being actively exploited to scale phishing and fraud, citing the ease with which attackers can register deceptive, brand-imitating domains and then force defenders into reactive, court-driven takedowns. The official argued that insufficient identity validation in domain registration and abuse concentration in certain networks (e.g., via **ASNs**) represent systemic gaps that enable business email compromise and link-based phishing campaigns across SMS and email. Threat intelligence reporting on Canada-linked fraud activity illustrates how these domain-registration weaknesses translate into operational campaigns: attackers are using lookalike domains, SMS lures, and paid ads to drive victims to convincing fake portals impersonating **PayBC, ServiceOntario, Canada Post, CRA, and Air Canada** to steal credentials and payment data. CloudSEK attributed much of the activity to the **“PayTool” phishing ecosystem**, describing reusable phishing kits and shared infrastructure that can be rapidly rebranded and expanded from provincial payment portals into broader “Government of Canada” themed entry points. Separate coverage of Anguilla’s `.ai` domain boom is primarily economic/industry-focused and does not provide substantive security reporting tied to the phishing and domain-abuse problem described above.
Jun 29, 2026
Palo Alto Networks Unit 42 reported an active supply-chain threat dubbed **phantom squatting**, in which large language models generate plausible but nonexistent brand-related domains that attackers later register and weaponize. In a study covering 913 global brands, 685,339 prompts across two LLM families produced 2.1 million URLs; researchers found 13,229 already classified as malicious and roughly 250,000 unregistered hallucinated domains that could be claimed by adversaries. The report says the technique creates a new path for phishing, malware delivery, and brand impersonation by exploiting domains that appear credible because they are syntactically consistent with legitimate organizations. Unit 42 said defenders observed multiple real-world cases in which hallucinated domains were identified **18 to 51 days** before attackers registered them, including a Montana Empire phishing operation and a postal-themed malicious Android APK campaign. The researchers warned that phantom-squatted domains can evade traditional reputation-based URL defenses because newly registered domains start with no threat history, while trusted AI assistants and autonomous agents may surface or use those domains directly, increasing software supply-chain and user-targeting risk.
Jul 2, 2026