Attackers Hijack Domain Registries to Obtain Fake Google TLS Certificates

What changed

Attackers took control of the `.gh`, `.sl` and `.as` domain registries, altered DNS records and obtained counterfeit TLS certificates for several Google domains and other major online services. Google blocked the identified certificates in Chrome and worked with certificate authorities to revoke those tied to Google properties.

Why it matters

TLS certificates are the digital credentials that help a browser confirm it is connecting to the real site. By controlling DNS records, the attackers passed automated checks designed to prove domain ownership, giving them a way to cryptographically impersonate selected services without breaking into those companies’ own infrastructure.

That makes this a failure in the chain around website identity, not necessarily a breach of Google or the other affected operators. Chrome’s blocklist reduces the danger for the certificates already identified, and Chrome users do not need to take action. But browser blocking is a cleanup measure, not a substitute for fixing control of the registries or finding every certificate issued during the hijack.

The practical lesson for domain owners is unusually specific: monitor certificate-transparency logs for unexpected certificates, and publish restrictive Certification Authority Authorization records in DNS. The number of unauthorized certificates and the identities of the non-Google organizations remain unknown, so the risk is reduced rather than neatly closed, especially for people using browsers without Chrome’s intervention.