Attackers who seized control of three small country domain registries used that access to obtain digital certificates that would let them impersonate Google and other companies online, Google disclosed this week. The company said its own systems were never breached, and that it has already moved to block the fraudulent certificates inside its Chrome browser.
The hijacks targeted three country-code top-level domains: .gh for Ghana, .sl for Sierra Leone, and .as for American Samoa. Anyone holding a domain ending in one of those suffixes was put at risk, because control of the registry lets an attacker rewrite the authoritative DNS records that point a name to a server.
With that control, the attackers requested HTTPS certificates for domains they did not own, including several belonging to Google. The scheme works because a certificate authority verifies control of a domain partly through its DNS records. If an attacker can change those records, they can pass the check and receive a certificate that makes their server look, to a browser, like the real Google.
Google said at least a dozen certificates were issued between late September and the end of the month for Google and YouTube names under the three hijacked domains, including addresses such as google.com.gh, google.sl, and google.as. With such a certificate, an attacker could intercept encrypted traffic and read data a user believed was going to Google.
The company’s response moved on two tracks. Inside Chrome, Google blocked the unauthorized certificates for its own domains using a mechanism called CRLSets, a list the browser downloads to reject certificates in emergencies without waiting for a full revocation. For users of other browsers and applications, Google worked with the certificate authorities that issued the rogue certificates to have them revoked.
The immediate message to users was reassurance: Chrome users need take no action to be protected. But the incident is a sharp reminder that the internet’s trust system is only as strong as its weakest registries. Country-code domains are run by organizations of widely varying size and security, and a handful of them are, in effect, the soft underbelly of the web’s security architecture.
Google framed the event as a problem of the domain system, not of its own infrastructure. The attackers compromised third-party registries, not Google’s servers or accounts, and the company stressed that no Google system was breached. The distinction matters for what it says about the attacker: the goal was not to get inside Google, but to impersonate it in front of its users.
The company also used the disclosure to press a set of recommendations it has repeated for years. It urged every organization to monitor Certificate Transparency logs, the public records of every certificate issued for a domain, which provide a near-real-time alert when an unexpected certificate appears. It also pointed to CAA records, which restrict which certificate authorities may issue for a given domain, as a second line of defense.
Those recommendations carry a practical edge. Google admitted that its analysis could not guarantee it had identified every affected domain, and that browser-side blocking alone should not be relied on to protect users. The honest advice, in other words, is that the companies running services on the internet have to do their own monitoring.
Analysts said the incident fits a known pattern of attacks on the domain name system itself, in which criminals and state-linked actors target the infrastructure people rarely think about rather than the websites they visit. The certificate is the payoff: once an attacker can mint one for a trusted name, they can stand between a user and the real service without ever touching the service.
Domain hijacking is an old attack made newly relevant. In past years, attackers have redirected traffic from banks, exchanges, and government sites through the same technique, steering users to impostor pages by changing the records that point a name to a server. What made this episode stand out was the scale of the targets and the use of valid certificates, which defeat the browser warnings that normally expose an impostor.
The episode also raised a question about who carries the burden of internet security. Browsers are increasingly the last line of defense, expected to catch bad certificates, block malicious downloads, and warn users away from phishing. Google’s decision to publish the details, and to push companies toward their own monitoring, is an argument that the browser cannot do the job alone.
For most people, the practical effect was invisible. Chrome blocked the bad certificates automatically, and the three domains involved are not the ones most users type every day. But the episode showed how fragile the web’s trust model remains, built as it is on hundreds of registries of varying competence, any one of which can be turned into a doorway to impersonate the internet’s biggest companies.
