Hackers use fake domain control to steal security certificates from Google

On Tuesday, Google reported that cybercriminals successfully hijacked three country code top-level domains—specifically .gh, .sl, and .as—to generate fraudulent TLS certificates. By manipulating authoritative DNS records within these namespaces, the attackers bypassed automated validation protocols. This breach allowed them to secure unauthorized cryptographic credentials for various Google domains alongside several other prominent global brands and digital services. In response, Google updated the Chrome browser to intercept these illegitimate certificates and coordinated with certificate authorities to revoke the compromised credentials.

This security incident highlights critical vulnerabilities in the digital trust infrastructure that relies on domain control validation. Because TLS certificates provide the essential encryption and authentication for websites and mail servers, such breaches can undermine the integrity of online communications. For the broader business community, these types of exploits may necessitate fundamental changes to how organizations manage, transmit, or report sensitive data, including digital invoices and tax documentation, to ensure continued protection against interception.