Google Warns Hackers Forged Digital Certificates for Google and Other Major Websites

Google has warned that cybercriminals compromised the domain infrastructure associated with Ghana, Sierra Leone and American Samoa, using the affected country-code top-level domains to obtain fraudulent HTTPS certificates for several Google domains and other organisations. The company disclosed the incidents on October 6, 2026, explaining that the attacks involved the .gh, .sl and .as domain namespaces. The attackers altered authoritative Domain Name System (DNS) records, allowing them to pass automated domain-control checks and obtain certificates that could make fraudulent websites appear legitimate. Google stressed that its own systems were not compromised; instead, the attackers exploited weaknesses in third-party domain infrastructure that supports internet services.

HTTPS certificates are essential to online security because they help browsers verify website identities and establish encrypted connections between websites and visitors. Normally, a trusted certificate helps users confirm that they are communicating with the intended website rather than an impersonator. However, when attackers obtain an unauthorised certificate for a legitimate domain, they may be able to impersonate that service if they can also redirect users’ internet traffic. Such an attack could potentially support phishing campaigns, credential theft or interception of sensitive information. The incident demonstrates that even widely trusted websites can face risks when weaknesses occur within the wider systems responsible for managing domain names and issuing digital certificates.

According to Google, the attackers obtained certificates covering several Google domains as well as domains belonging to other organisations. Google did not publicly identify every affected domain or name all the other companies involved. Reporting by cybersecurity publications found evidence of certificates issued between September 22 and September 27, 2026. The attacks appear to have affected the three country-code domain namespaces in succession, although the precise method used to compromise their registry infrastructure remains undisclosed. Google also stated that it had no reason to believe the certificate authorities that issued the affected certificates had acted improperly, because the attackers had manipulated DNS records to satisfy the normal validation process.

Google said it responded by blocking the unauthorised certificates in Chrome through its emergency certificate-blocking mechanism and working with the relevant certificate authorities to revoke them. The company also examined public Certificate Transparency logs, which record the issuance of publicly trusted certificates, and identified additional organisations believed to have been affected. Chrome users do not need to take any special action to receive the protection provided by these blocks. However, Google warned that browser-based protection should not be considered sufficient for every situation, particularly because other browsers and applications may respond differently and investigators cannot guarantee that every affected domain has been identified. Domain owners have therefore been advised to monitor certificate records and strengthen their own security controls.

The incident highlights the importance of securing the internet’s underlying infrastructure, not just individual websites. Google recommends that organisations continuously monitor Certificate Transparency logs for unexpected certificates and configure restrictive Certification Authority Authorisation records, which specify which certificate authorities are permitted to issue certificates for their domains. These measures can help organisations detect suspicious activity and reduce the risk of unauthorised certificate issuance. The attacks also raise questions about the security standards maintained by third-party domain registry operators, whose systems can affect thousands of websites. Although the fraudulent certificates have been revoked, the full extent of the incident remains unclear because Google has not disclosed every affected organisation. The case serves as a reminder that protecting internet users requires cooperation between browser developers, domain registries, certificate authorities and website operators.