ConciseSignal
Following
CybersecurityConfirmed

Hackers hijack ccTLDs to forge Google certificates

Attackers gained control of the main domain registries for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as), allowing them to manipulate DNS records and fraudulently obtain HTTPS certificates for Google and several other organizations. Google says its systems were not breached. Chrome responded by blocking the unauthorized certificates, and Google worked with certificate authorities to revoke them, but undiscovered certificates may still pose a risk.

Why it mattersThis incident enables attackers to impersonate legitimate websites, intercept encrypted data, and perform convincing phishing attacks. The slow revocation process highlights ongoing vulnerabilities in global web security infrastructure.

Sources covering this

Ars TechnicaHackers obtain counterfeit TLS certificates for Google and other large services7:21 PM →The Hacker NewsAttackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains6:48 PM →The RegisterHeadline onlyAttackers hijacked top-level domains, minted fake security certs for Google and other orgs7:38 PM →BleepingComputerHackers hijack Google domains after breaching ccTLD registries8:50 PM →TechRadarGoogle says counterfeit TLS certificates of major services stolen by hackers2:20 PM →Infosecurity MagazineAttackers Hijack Three ccTLDs to Obtain Google Certificates2:30 PM →SecurityWeekHeadline onlyGoogle Domains Impacted by Recent ccTLD Hijacks11:43 AM →

How it unfolded

  • Ars Technica Hackers obtain counterfeit TLS certificates for Google and other large services
  • The Hacker News Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains
  • The Register Attackers hijacked top-level domains, minted fake security certs for Google and other orgs
  • BleepingComputer Hackers hijack Google domains after breaching ccTLD registries
  • TechRadar Google says counterfeit TLS certificates of major services stolen by hackers
  • Infosecurity Magazine Attackers Hijack Three ccTLDs to Obtain Google Certificates
  • SecurityWeek Google Domains Impacted by Recent ccTLD Hijacks

In this story

Concise Signal DailyEnterprise AI, security & business tech.Weekdays, 7am Eastern · Sample issue

More in Cybersecurity