A serious Google domain hijack unfolded after hackers breached three country-code top-level domain registries to obtain unauthorized HTTPS certificates for Google properties, Google announced on October 6 [2]. The incident affected ccTLDs (country-code top-level domains) for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as), modifying root DNS records without penetrating Google’s own internal networks or production systems [1]. Security engineers acted quickly to revoke the bogus certs and push browser safeguards, so everyday users don’t need to take manual steps to protect their accounts [2].
Google Domain Hijack Hits Regional Registry Systems
The attacks didn’t start from weaknesses inside Google databases or cloud platforms. Instead, hackers breached registry operators that manage domain name system records for Ghana, Sierra Leone, and American Samoa. By gaining control over those root registries, the threat actor altered DNS entries to reroute web traffic to servers under their own control. The crew acted quickly [1].
To secure an HTTPS cert, a user must prove control of the targeted domain name to a Certificate Authority (CA). Standard automated checks typically need an applicant to publish a specific TXT record with a random string from the CA. Because the hackers controlled root DNS records during the breach, they set up the required test records and passed domain ownership checks for names they didn’t own, letting them trick automated validation systems without raising alarms. With registry access secured, the intruders altered DNS pointers so local traffic routed to their own systems, clearing the path to request valid TLS certificates from public issuers. This let the crew spoof real web pages over secure links [1].
With valid TLS certs in hand, hackers could mimic real websites over secure links and serve arbitrary content to unsuspecting visitors [1]. Users visiting those hijacked addresses saw a normal padlock icon, making it hard to spot rogue activity [2]. Unlike device vulnerabilities where Google Pixel phones patched a zero-click modem flaw at the local firmware level, this attack occurred entirely in third-party naming systems outside Google’s perimeter without touching user hardware [1].
Unauthorized Certificates Surface in Public CT Logs
Evidence of the rogue requests quickly showed up in public Certificate Transparency logs, which serve as an open ledger recording all certs issued by trusted authorities. Writers at The Hacker News found the illicit activity on October 7 by querying public monitoring tools, including ctlogs.dev and Cert Spotter. Their audit uncovered at least 12 domain-validated certificates issued between September 22 and September 27 for seven Google and YouTube sites in the three country domains, proving that hackers sought keys for multiple local services at once. These records included domains like google.com.gh, google.sl, google.com.sl, youtube.sl, and google.as. Cert Spotter logged the details [2].
Issuers Let’s Encrypt and ZeroSSL produced the fake credentials during the breach. Eleven certs came from Let’s Encrypt, while ZeroSSL issued one. The rollout unfolded in separate waves, hitting one registry at a time. The two .gh certs were logged on September 22, the six .sl certs appeared on September 25, and the four .as certs emerged on September 27. Seven localized names faced attacks [2].
Historically, every other cert for those country domains since at least September 10 came from Google Trust Services, Google’s proprietary CA. When users on community forums asked about the incident, Let’s Encrypt staff member Matthew McPherrin clarified the situation on October 7: “Yes, certificates for Google and YouTube were issued, and have been revoked”. Because researchers audited a targeted subset of names, the total volume of affected certs might be higher under the breached registries [2].
Google Domain Hijacking Triggers Browser Protections
Google moved quickly to protect web users once it spotted the bogus keys. The company deployed CRLSets, an emergency tool inside Google Chrome designed to block revoked or untrusted HTTPS certificates without requiring a full browser update. Through this tool, Chrome setups automatically rejected the counterfeit certs whenever a user tried to connect to the affected Google domains. Google stated that Chrome users don’t need to take any manual steps to stay safe from the incident [1].
Chrome interventions don’t protect people who browse the web through other browsers or standalone applications. Google cautioned in its advisory: “Due to the complexity of DNS hijacks, we cannot guarantee that our analysis identified every affected domain, nor do Chrome interventions reliably protect non-Chrome users” [1]. To ensure wider protection for all internet clients, Google worked with the issuing CAs to revoke the rogue files entirely [2]. Revocation through the CAs ensures that any client checking cert status will drop the counterfeit credentials [1].
Revocation records confirmed that all 12 certs were pulled by October 7. The two certs under .gh and the ZeroSSL cert were revoked on September 26, while the remaining nine certs under .sl and .as were revoked on October 1. The gap between logging and revocation ranged from about 1.5 days to nearly a full week. Ten certs were pulled October 1 [2]. Furthermore, examination of CT data showed that other organizations, including prominent global brands and widely accessed web services, were believed to have been hit during the same registry breaches [1].
Can Hackers Hack Google Systems Through DNS?
The incident prompted many web users to ask whether hackers breached Google itself [2]. Google explained that its internal production servers and systems were never breached during the attack. The breach occurred solely at third-party registry operators responsible for the .gh, .sl, and .as country-code domains. Because the hackers gained access to the registry databases, they could alter DNS records for any domain hosted under those top-level suffixes, regardless of who owned the name or managed the underlying website [1].
Can attackers compromise user data when they hijack DNS records without touching core Google servers? If hackers control DNS, they can redirect visitors to imposter servers and display phishing pages designed to steal passwords or private communications [2]. With a valid TLS cert issued in Google’s name, the fake site shows a trusted HTTPS padlock, making detection hard for everyday visitors. Google stated that it has no reason to believe that issuing CAs acted improperly, as the issuers followed standard automated validation protocols [1].
Google learned of the hijacks during the week before its October 6 security advisory and began blocking rogue certs right away. Google acted without delay. The company’s post didn’t name the threat actors behind the attacks, nor did it disclose how the third-party registries were penetrated. Google also didn’t reveal whether hackers managed to serve bad pages to actual visitors before the certs were revoked [2]. The event shows that online services remain vulnerable when upstream naming providers get compromised [1].
Protective Steps for Domain Owners After Hijacks
Following the incident, Google recommended specific security measures for groups managing country-code domain names. First, administrators should monitor public Certificate Transparency logs in their entire domain portfolio, including inactive and parked names [1]. Monitoring tools alert domain owners as soon as a CA issues a cert for one of their domains. Because ccTLD names often become targets in DNS attacks, reviewing recent log entries helps teams spot unrequested certs before hackers can abuse them [2].
Second, groups should publish restrictive Certification Authority Authorization records in their DNS configuration [1]. A CAA record specifies which certificate authorities have permission to issue certificates for a domain [2]. While a CAA entry can’t stop cert creation during an active DNS hijack, it prevents hackers from requesting extra certs using cached validation once legitimate DNS control is restored to the rightful owners [1]. Under CA/Browser Forum Baseline Requirements, CAs can reuse domain validation for up to 200 days, though that limit drops to 100 days in March 2027 and 10 days in March 2029 under new forum timelines. All seven affected domains carried restrictive records [2].
Let’s Encrypt currently reuses domain checks for 30 days and plans to reduce that window to 7 hours by 2028. Third, domain administrators who detect unauthorized certs should file a Certificate Problem Report with the issuing authority. Under industry standards, CAs must investigate reports and release preliminary findings within 24 hours. Pre-checks drop to 10 days in 2029. By October 7, all seven affected Google domains had restrictive CAA records pointing solely to pki.goog, the domain of Google Trust Services [2].
- ONLINE NEWS Toulas, B. (2026, October 7). Hackers hijack Google domains after breaching ccTLD registries. BleepingComputer. [Article Link]
- ONLINE NEWS The Hacker News. (2026, October 8). Attackers Hijack.gh,.sl, and.as Registries to Obtain Certificates for Google Domains. The Hacker News. [Article Link]
