Reported by 9 outlets
Hackers obtain counterfeit TLS certificates for Google and other large services
Why this score
- Breadth
- 2.00 / 2.0 · 9 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.45 / 0.6 · time to second source
- Recency
- × 0.03 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.1 / 10 = base × recency + community
Desk analysis
Attackers breached the registry operators behind three country-code top-level domains (.gh Ghana, .sl Sierra Leone, .as American Samoa), edited authoritative DNS records, and passed certificate-authority validation to obtain counterfeit TLS certificates for Google domains and other organizations. Google's disclosure puts the count at unauthorized certificates confirmed through Certificate Transparency logs; one report cites 12 forged certificates. The certificates were genuine, CA-signed documents issued to an attacker who could demonstrate DNS control rather than real ownership.
The technique bypasses the trust model rather than breaking encryption. Domain validation for HTTPS issuance typically relies on a TXT record challenge; control over authoritative DNS answers that challenge, so the attacker obtained valid certificates for domains they never controlled. Because ccTLDs issue domains to anyone regardless of geography, this exposed users well beyond the three countries. Successful abuse enables convincing brand impersonation with a padlock in the browser.
Google blocked the unauthorized certificates for its properties in Chrome via CRLSets and worked with the issuing CAs to revoke them. The company states its own systems were not compromised and that it has no reason to believe the CAs acted improperly. Ars Technica first reported the story on October 6; Google published its Chrome response on October 8.
What to watch: CT logs for additional certificates issued under .gh, .sl, or .as, whether the other affected organizations disclose, and whether the ccTLD operators publish incident detail. Registry-level compromise of this kind is rare and the response playbook for it, CA/Browser Forum side, is still unsettled.
Timeline
-
original reporting
Hackers obtain counterfeit TLS certificates for Google and other large services https:// lemmy.zip/post/72782104
arstechnica.com · 7d ago · October 6th, 2026
Hackers obtain counterfeit TLS certificates for Google and other large services https:// lemmy.zip/post/72782104
via Mastodon https://arstechnica.com/security/2026/10/hackers-obtain-counterfeit-tls-certificates-for-google-and-other-large-services/
-
mentioned by arstechnica.com
Hackers obtain counterfeit TLS certificates for Google and other large services https://arstechnica.com/security/2026/10/hackers-obtain-coun
arstechnica.com · 7d ago · October 7th, 2026
-
update from arstechnica.com
Hackers obtain counterfeit TLS certificates for Google and other large services | Compromise of 3 domain registries allows hackers to walk off with unauthorized certs.
arstechnica.com · 6d ago · October 7th, 2026
submitted by /u/uid_0 [link] [comments]
via reddit r/cybersecurity: Hackers obtain counterfeit TLS certificates for Google and other large services | Compromise of 3 domain registries allows hackers to walk off with unauthorized certs.
-
mentioned by arstechnica.com
Hackers obtain counterfeit TLS certificates for Google and other large services Compromise of 3 domain registries allows hackers to walk off
arstechnica.com · 6d ago · October 7th, 2026
-
update from bleepingcomputer.com
Hackers hijack Google domains after breaching ccTLD registries
bleepingcomputer.com · 6d ago · October 7th, 2026
Hackers obtained unauthorized HTTPS certificates for several Google domains and hijacked domains in the country-code top-level domains (ccTLDs) for Ghana, American Samoa, and Sierra Leone after compromising third-party operators and modifying authoritative DNS records. Google underlines that the attacks affected domains of other organizations in the .GH, .SL, and .AS ccTLDs but "did not involve a compromise of Google’s systems." By gaining access to the domain name system (DNS) records, a threat actor can request an HTTPS certificate from a Certificate Authority (CA) for a domain they don't own. CAs issue certificates after verifying ownership of the domain, a process that typically requires the requester to create a TXT record with a random value the CA provides. Modifying the authoritative DNS records allowed the threat actor to point .GH, .SL, and .AS domains to infrastructure they controlled while obtaining valid TLS certificates for those domains. This let the attacker impersonate legitimate brands and serve visitors arbitrary content from the affected domains. Google immediately blocked the unauthorized certificates for its properties in Chrome through CRLSets and worked with the issuing authorities to revoke them, extending protection to other clients. The company said that its systems were not affected by the incident in any way, and that it has no reason to believe that the issuing CAs acted improperly. After examining Certificate Transparency (CT) logs, the tech gia
-
update from zubiqo.com
Attackers hijacked three country-code registries (.gh, .sl, .as) and manipulated DNS records to secure 12 unauthorized HTTPS certificates fo
zubiqo.com · 6d ago · October 7th, 2026
Attackers hijacked three country-code registries (.gh, .sl, .as) and manipulated DNS records to secure 12 unauthorized HTTPS certificates fo
via Mastodon https://zubiqo.com/news/attackers-hijack-three-national-domain-registries-to-forge-google-https-certificates-g0oa2v
-
mentioned by www.bleepingcomputer.com
Hackers reportedly compromised ccTLD registries to hijack Google domains and forge TLS certificates
www.bleepingcomputer.com · 6d ago · October 7th, 2026
-
update from threataft.com
Google ccTLD Registry Hijacks — Supply-Chain DNS Attack Mints Valid TLS Certificates for Major Brands
threataft.com · 6d ago · October 8th, 2026
By controlling registry-level DNS, they passed automated domain control validation and obtained unauthorized HTTPS certificates for Google domains and other leading global brands. The incident exposes dependency of TLS issuance on DNS-based validation at the registry layer.
-
update from threataft.com
Attackers compromised .gh, .sl, and .as ccTLD registries. Modified authoritative DNS. Passed automated domain control validation. Got valid
threataft.com · 6d ago · October 8th, 2026
Attackers compromised .gh, .sl, and .as ccTLD registries. Modified authoritative DNS.
-
mentioned by thehackernews.com
🤖 Attackers compromised three ccTLD registries (.gh Ghana, .sl Sierra Leone, .as American Samoa), altered authoritative DNS records and obta
thehackernews.com · 6d ago · October 8th, 2026
-
update from gbhackers.com
Attackers Hijack .gh, .sl, and .as Domains to Obtain Unauthorized SSL Certificates
gbhackers.com · 5d ago · October 8th, 2026
Attackers Hijack Domains In a disclosure on October 6, 2026, Chrome’s Secure Web and Networking Team stated that these […] The post Attackers Hijack .gh, .sl, and .as Domains to Obtain Unauthorized SSL Certificates appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from blog.google
Three country-code registries fell, Google disclosed on Tuesday: Ghana's .gh, Sierra Leone's .sl and American Samoa's .as, where attackers r
blog.google · 5d ago · October 8th, 2026
Three country-code registries fell, Google disclosed on Tuesday: Ghana's .gh, Sierra Leone's .sl and American Samoa's .as, where attackers r
via Mastodon https://blog.google/security/chromes-response-to-recent-cctld-registry-hijacks/
-
update from malware.news
Attackers hijack country-code domains to impersonate Google and other services
malware.news · 5d ago · October 8th, 2026
These domain endings aren’t limited to sites serving those countries, so the risk can extend to users elsewhere. This wasn’t a break in encryption, and Google’s systems weren’t compromised. Instead, attackers manipulated the internet’s addressing infrastructure so they could pass the checks required to obtain certificates for domains they didn’t legitimately control. The Domain Name System (DNS) helps direct internet traffic to the right destination. Control over DNS can also provide a way to demonstrate apparent control of a domain when requesting an HTTPS certificate. An HTTPS certificate helps a browser authenticat e the server it is connecting to . A trusted certificate authority issues the certificate after checking that the applicant controls the relevant domain. The authority can then issue a genuine, signed certificate to someone who has hijacked the domain’s infrastructure. Combined with the ability to redirect a victim’s traffic to an attacker-controlled server, that could enable cybercriminals to create a convincing impersonation of the real service.
-
mentioned by www.malwarebytes.com
(malwarebytes.com) Infrastructure Compromise: How Attackers Hijacked ccTLD Registries to Obtain Fraudulent HTTPS Certificates In brief - Thi
www.malwarebytes.com · 5d ago · October 8th, 2026
-
mentioned by arstechnica.com
🔒️ Hackers obtain counterfeit TLS certificates for Google and other large services https:// arstechnica.com/security/2026/ 10/hackers-obtain
arstechnica.com · 5d ago · October 8th, 2026