Attackers Hijack Three National Domain Registries to Forge Google HTTPS Certificates

Attackers compromised the country-code top-level domains (ccTLDs) for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as) to generate unauthorized HTTPS certificates for global enterprise domains. Threat actors manipulated authoritative DNS records at the registry level, allowing them to pass domain validation checks and potentially impersonate sites over encrypted connections to intercept private data. Let's Encrypt issued 11 of the 12 known forged certificates for Google and YouTube domains between September 22 and 27, while ZeroSSL issued one. Google's internal systems were not breached. The company deployed emergency CRLSet blocks within Chrome to neutralize the threat and confirmed that other widely used global brands were also swept up in the registry hijack. "Yes, certificates for Google and YouTube were issued, and have been revoked." — Matthew McPherrin