New HalluSquatting attack uses AI assistants to create massive botnets

HalluSquatting exploits AI coding assistants' tendency to hallucinate nonexistent code repositories, luring them to download malicious code from squatted names. The pull-based attack affects nine popular tools including Cursor and GitHub Copilot, enabling large-scale botnet assembly and DDoS attacks.