Hackers Exploit Hijacked Country‑Code Domains to Obtain Google TLS Certificates

Hackers who compromised three country‑code top‑level domains have managed to secure HTTPS certificates for a number of Google‑owned web addresses, prompting security researchers to flag a fresh supply‑chain risk for the tech giant.

The affected top‑level domains – .gh (Ghana), .sl (Sierra Leone) and .as (American Samoa) – were reportedly seized in a series of coordinated attacks that gave the perpetrators control over the domain name system entries for those zones.

With administrative access to the compromised registries, the attackers were able to satisfy the domain‑validation checks required by certificate‑issuing authorities, resulting in the issuance of legitimate‑looking TLS certificates for Google‑related subdomains. The certificates, while technically valid, could be used to impersonate Google services in phishing or man‑in‑the‑middle scenarios.

Security analysts warn that the presence of a trusted certificate does not guarantee that a site is safe, especially when the underlying DNS records have been tampered with. Users who encounter Google URLs that resolve to unexpected IP addresses may be exposed to credential harvesting or malware distribution, even though the browser indicates a secure connection.

Google has not disclosed detailed mitigation steps, but statements from the company’s security team indicate that the firm is working with the affected registries and certificate authorities to revoke the fraudulent certificates and restore proper DNS delegation.

The incident underscores ongoing concerns about the security of country‑code registries, many of which operate with limited resources and varying levels of oversight. Past incidents have shown that a breach at the registry level can cascade into broader trust‑model failures for the global internet.

Industry experts say the event may accelerate calls for stronger validation mechanisms, such as stricter implementation of the DNS Certification Authority Authorization (CAA) records and broader adoption of DNSSEC to protect the integrity of domain name data.

For now, users are advised to remain vigilant, verify URLs carefully, and monitor any security alerts issued by Google or their email providers. The broader security community will be watching how quickly the compromised certificates are withdrawn and what steps are taken to harden the vulnerable ccTLD infrastructures.