Security researchers report that unaffiliated threat actors compromised third-party operators and modified authoritative DNS records to obtain unauthorized HTTPS certificates for several Google domains and hijack domains in the country-code top-level domains for Ghana, American Samoa, and Sierra Leone. The full scope and specific domains affected remain under investigation.

Which products are affected?

Google domains, ccTLD registries for Ghana, American Samoa, Sierra Leone

What should defenders do?

Google and affected ccTLD registries are likely implementing remediation. Organizations should monitor certificate transparency logs for anomalous issuance, implement DNSSEC to validate DNS responses, enforce certificate pinning or CT monitoring, and remain vigilant for phishing or man-in-the-middle attempts leveraging the hijacked domains.

highCyber Attacks

Hackers Hijack Google Domains After Breaching ccTLD Registries

Unauthorized HTTPS certificates issued; Ghana, American Samoa, and Sierra Leone domain redirection reported

Cyber.TechVoidPublished about 1 hour agoUpdated less than a minute ago1 min read

Hackers Hijack Google Domains After Breaching ccTLD Registries

Key Takeaways

Unauthorized HTTPS certificates obtained for Google domains and ccTLDs in Ghana, American Samoa, and Sierra Leone.
Attack involved compromise of third-party operators and modification of authoritative DNS records.
Full scope of affected domains and exact exploitation methods remain under investigation.
Google and affected registries are working on remediation.

Related Security News

highCyber Attacks

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

Google reported on October 6, 2026, that threat actors compromised the registry operations of three country-code top-level domains (.gh, .sl, and .as) and obtained unauthorized HTTPS certificates for several Google domains. Google confirmed its own infrastructure was not breached, but any domain ending in these ccTLDs was placed at risk of impersonation. With fraudulent certificates, attackers could execute man-in-the-middle or phishing attacks against end-users visiting affected domains.

The Hacker Newsabout 1 hour ago1 min read