Hackers hijack domain registries to forge TLS certificates for Google, other tech giants

Threat actors have successfully compromised DNS infrastructure across three country-level registries to manufacture fraudulent TLS certificates mimicking Google and numerous other prominent organizations, according to a disclosure by Google on Tuesday.

The adversaries targeted the .gh, .sl, and .as country-code top-level domains, gaining the ability to alter authoritative DNS configurations for specific services within those zones. This control enabled them to circumvent the automated verification procedures that certificate authorities rely on to validate domain ownership and issue TLS credentials for "several Google domains" alongside "multiple global brands and prominent online platforms." Google has deployed Chrome updates to block the counterfeit certificates and coordinated with certificate authorities to revoke unauthorized credentials for its own properties.

How TLS certificates secure the internet#

TLS certificates serve as the cryptographic foundation for website authenticity and encrypted communication across email, web services, and critical internet systems. These x.509-based credentials use digital signatures to cryptographically bind domain names—such as google.com—to public encryption keys. While the public key remains openly visible, only legitimate site operators retain the paired private key. When a visitor's browser verifies that both keys align, it confirms connection to the legitimate site rather than an attacker's fake version. Fraudulent certificate possession allows criminals to conduct man-in-the-middle attacks and convincingly masquerade as legitimate services.

Recommended protections for domain owners#

Google has not disclosed which of its specific domains were compromised or identified any of the affected third-party organizations. While Chrome users require no manual action for protection, Google emphasizes that relying solely on browser-side defenses is insufficient. The company recommends domain owners proactively scan certificate transparency logs to detect unexpected certificate issuance and establish restrictive Certification Authority Authorization DNS records—these policies can block attackers from reusing cached validation results if DNS control is regained after an intrusion.