Attackers Hijack Domain Registries to Obtain Certificates for Google and Others

What happened to the domain registries?

In late September 2026, attackers compromised the registries for three country-code top-level domains (ccTLDs): .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) [The Hacker News↗ (opens in a new tab)]. By gaining control over the DNS records for these domains, the attackers were able to request and obtain HTTPS certificates for several Google domains, including google.com.gh, google.sl and google.as. These certificates are meant to prove that a website is genuine and to encrypt traffic between users and the site.

Google confirmed the incident on 6 October 2026. The company said its own systems were not breached, but any domain under the affected ccTLDs was at risk. The attack also affected other organisations, including well-known global brands and widely used online services, though Google did not name them [BleepingComputer↗ (opens in a new tab)][Infosecurity Magazine↗ (opens in a new tab)].

How did the attackers get the certificates?

To get an HTTPS certificate, a Certificate Authority (CA) must confirm that the requester controls the domain. This is usually done by adding a special record to the domain's DNS. By hijacking the registries, the attackers could change DNS records and pass these checks, even though they did not own the domains. Let's Encrypt issued 11 of the 12 certificates found, and ZeroSSL issued one. The certificates were issued between 22 and 27 September 2026, one ccTLD at a time.

Certificate Transparency (CT) logs, which publicly record all certificates issued, show at least 12 certificates for Google and YouTube domains under the three ccTLDs. The real number could be higher, as only a small set of names was checked.

What did Google and others do in response?

Google used Chrome's CRLSets, an emergency mechanism, to block the unauthorised certificates for its domains. It also worked with the CAs to revoke the certificates, which protects users of other browsers and apps. By 7 October, all 12 certificates had been revoked. The shortest time between a certificate being issued and revoked was about a day and a half. The longest was nearly a week.

Google also blocked certificates for other organisations it believed were affected and contacted them where possible. The company warned that its analysis might not have found every affected domain, and that Chrome's protections do not cover users of other browsers.

What is the risk to users and domain owners?

With a valid certificate, an attacker could impersonate a trusted site and intercept or read private data sent to it. There is no public evidence so far that the certificates were used in this way, but Google has not ruled it out. Chrome users are protected by the emergency blocks, but users of other browsers may still be at risk if a revoked certificate is used before the browser updates its records.

Domain owners under .gh, .sl or .as should check CT logs for certificates they did not request. Google recommends publishing a strict Certification Authority Authorization (CAA) record in DNS, which limits which CAs can issue certificates for a domain. However, this does not stop an attacker who controls DNS during a hijack, but it does help once control is restored.

What should domain owners do now?

Google advises domain owners to:

• Monitor CT logs for all their domains, including regional and parked domains.
• Publish a strict CAA record naming only their chosen CA.
• Report any unauthorised certificates to the CA that issued them. CAs must investigate and respond quickly.

The rules for how long a CA can reuse a domain check are changing. By 2029, the maximum will be 10 days, down from the current 200 days for some CAs. Let's Encrypt already limits this to 30 days and plans to reduce it further.

What is still unclear?

The sources do not name the attackers, explain how the registries were compromised, or confirm whether any certificates were actively used to attack users. There is also no confirmation that the registries have been secured.