Attackers hijacked top-level domains, minted fake security certs for Google and other orgs

Hackers have taken control of key website addresses, creating fake versions of Google and other well-known sites. Attackers manipulated the internet's domain name system (DNS) records and created fake security certificates for several Google domains and those of other organizations. The attacks occurred in the .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) country-code top-level domains. Google was alerted to the incidents last week.

During the hijacks, the cybercriminals altered the authoritative DNS records and obtained unauthorized HTTPS certificates covering Google domains and domains of other organizations. However, Google's systems remained unaffected, and Chrome swiftly blocked suspected counterfeit certificates for the affected ccTLDs, ensuring protection for Chrome users.

The attackers can now impersonate legitimate organizations and websites without triggering browser security alerts, enabling them to intercept or modify data sent by users to the impersonated sites. This could allow them to distribute malware or launch phishing attacks, abusing the trusted organization's brand.

Google advises domain owners to monitor Certificate Transparency (CT) logs for their domains, including parked or regional ccTLD properties, to identify unauthorized certificates in near real-time. If an organization operates a domain in .gh, .sl, or .as, they should review recent CT log entries for any unexpected certificates. Additionally, organizations can publish restrictive Certification Authority Authorization (CAA) DNS records, limiting certificate issuance to specific authorized accounts and validation methods, preventing attackers from minting new certificates after a hijacking ends.