Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

Attackers compromised three country-code top-level domain (ccTLD) registries — .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) — and obtained unauthorized HTTPS certificates for several Google domains. While Google's own infrastructure was not directly breached, the compromise of these registries put all domains under those ccTLDs at risk. With fraudulent certificates in hand, attackers could impersonate legitimate Google sites over encrypted HTTPS connections, potentially enabling man-in-the-middle attacks or credential theft. The incident highlights the systemic risk posed by weakly secured national domain registries. Google disclosed the issue on October 6, 2026, and the attack represents a significant abuse of the certificate issuance process tied to domain control validation.