Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

On October 6, 2026, Google announced that unauthorized parties had compromised the registry systems of three country-code top-level domains: .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa). The threat actors used the compromise to obtain HTTPS certificates valid for Google domains, despite Google's own systems remaining unbreached.

The compromise of ccTLD registries represents a significant trust violation, as certificate authorities for these zones can issue certificates for any domain within their TLD. Google stated that end-users visiting domains ending in .gh, .sl, or .as could be subjected to man-in-the-middle attacks or phishing if they encounter fraudulent certificates.

Google and the affected TLD registries are reportedly working on mitigation. The company advised domain owners to monitor certificate transparency logs and revoke any unauthorized certificates discovered. No software patch is required for end-users beyond standard certificate validation awareness.

Technical details regarding the exact method of TLD compromise and the specific Google domains targeted have not been publicly disclosed as of the report date. Google's confirmation that its core infrastructure was not breached has not been independently verified through Google's official security blog or CERT advisories.