Google has disclosed a serious domain hijacking campaign that gave attackers unauthorised HTTPS certificates for several Google domains. The group behind the attack broke into third-party operators of the country-code top-level domains for Ghana (.gh), Sierra Leone (.sl) and American Samoa (.as), then changed authoritative DNS records. Google confirmed that its own systems were not compromised in any way.
The incident is a reminder that the security of major websites depends on smaller infrastructure providers that most users never see, from country domain registries to certificate authorities.
How the domain hijack worked
When someone requests an HTTPS certificate, the certificate authority verifies control of the domain, usually by asking the requester to place a random TXT record in the domain’s DNS settings. Because the attackers had already modified the authoritative DNS records for domains in the .gh, .sl and .as zones, they could pass this check for domains they did not own.
With valid TLS certificates in hand and DNS pointing to infrastructure they controlled, the attackers could impersonate legitimate brands and serve visitors arbitrary content over a connection that browsers marked as secure. Affected domains included properties of other organisations, not just Google.
How Google responded
Google blocked the unauthorised certificates for its properties in Chrome using CRLSets, an emergency mechanism for quickly untrusting selected certificates, and worked with the issuing authorities to revoke them. After reviewing Certificate Transparency logs, the company found additional certificates linked to the same attacks and blocked those as well. Google said the logs revealed more affected organisations, including several leading global brands and widely used online services.
Chrome users do not need to take any action. However, Google warns that its analysis may not have identified every affected domain, and that CRLSets only protects Chrome. Users on other browsers could still be exposed until the certificates are revoked across the board.
What domain owners should do now
Google is urging organisations to monitor Certificate Transparency logs across their whole domain portfolio, including parked domains, since a certificate issued without permission shows up in those logs. The company also recommends publishing restrictive CAA records where possible. CAA records cannot stop certificate issuance during an active DNS hijack, but they block follow-up certificates that rely on cached validation once legitimate DNS control is restored.
For Indian businesses that hold country-code domains or work with regional registrars, the practical lesson is to audit who operates the registry side of your domains and to set up alerts for unexpected certificate issuance. Google has not identified the attackers or said how many certificates were hijacked in total.
FAQ
Were Google accounts or Gmail affected by this attack?
No. Google states the incident did not involve any compromise of its systems. The problem was unauthorised certificates and DNS changes at country-code domain registries.
Do I need to change my passwords?
There is no indication that user credentials were exposed. Keeping your browser updated is the main protective step, since that is how certificate blocks reach you.
Am I safe if I use Firefox or Edge?
Google’s CRLSets only cover Chrome. Other browsers rely on their own revocation mechanisms, so protection depends on the certificate authorities completing revocation everywhere.
What is a CAA record?
A Certification Authority Authorization record is a DNS entry that tells certificate authorities which of them may issue certificates for your domain, limiting unauthorised issuance.
