Threat Intel
Unauthorized HTTPS Certificates Issued for Google Domains via Hijacked .gh, .sl, .as Registries
Attackers compromised the .gh, .sl, and .as ccTLD registries, obtaining 12 unauthorized domain‑validated certificates for Google and YouTube domains. Google’s own systems were untouched, but the certificates could allow attackers to impersonate Google sites over TLS. Defenders should verify DNS integrity, monitor Certificate Transparency logs, and ensure revoked certificates are propagated via CRL sets.
What Happened
Between September 22 and 27, attackers altered authoritative DNS records for the .gh, .sl, and .as country‑code top‑level domains. This enabled them to request and receive 12 domain‑validated HTTPS certificates from Let’s Encrypt (11) and ZeroSSL (1) for Google and YouTube subdomains such as google.com.gh, google.sl, and google.as.
Impact
Any domain ending in .gh, .sl, or .as is now vulnerable to man‑in‑the‑middle attacks if an attacker presents one of the rogue certificates. Google’s own infrastructure was not compromised, but the certificates could be used to spoof Google services over encrypted connections.
Mitigation Steps
- Verify that no unauthorized certificates exist for your domains in Certificate Transparency logs.
- Ensure DNS records for your ccTLD domains are signed and monitored for tampering.
- Coordinate with the issuing CAs to revoke any rogue certificates immediately.
- Deploy CRL sets or OCSP stapling to block revoked certificates in browsers and applications.
Monitoring Recommendations
- Regularly query CT log services (e.g., ctlogs.dev, Cert Spotter) for new certificates matching your domain names.
- Set up alerts for changes to authoritative DNS records at your registrar.
- Review browser and server logs for unexpected TLS handshakes involving your domains.
Related articles
Corp MDM Android Spyware Targets Logistics Sector via Fake Google Play Pages
A targeted campaign is distributing Android spyware known as Corp MDM via fraudulent Google Play landing pages impersonating logistics brands. The malware, packaged as a system service, is designed to intercept inbound SMS traffic, manipulate call routing, and maintain persistent background execution using a hard-coded command-and-control infrastructure.
Read briefing
ClearFake Campaign Uses WebDAV and Fake CAPTCHA Lures to Deploy Amatera Stealer
Cybersecurity researchers have uncovered a new ClearFake infection campaign that leverages fake Google CAPTCHA prompts and WebDAV shares to distribute the Amatera information stealer. The multi-stage attack tricks users into running malicious commands, resulting in the deployment of secondary payloads such as ZigCryptoStealer, a Go-based reverse proxy, and unauthorized instances of NetSupport Manager. Activity targeting a Ukrainian government organization has been linked to a threat cluster tracked as UAT-10820.
Read briefing
Tycoon 2FA AiTM: The Phishing‑as‑a‑Service Threat That Bypasses MFA on Entra ID & Google Workspace
Tycoon 2FA, the top‑selling phishing‑as‑a‑service kit, has evolved into a sophisticated adversary‑in‑the‑middle tool that captures MFA‑protected session tokens for Microsoft 365 and Google Workspace. After a March 2026 takedown, operators pivoted to device‑code phishing and OAuth abuse, keeping the kit at the forefront of global phishing trends. Elastic’s new detection rules map telemetry fingerprints across both platforms, enabling rapid incident containment in under ten seconds via Elastic Workflows.
Read briefing
Keycloak 26.7.x Security Policy Bypass Vulnerability (CVE‑2026‑90997) – Immediate Patch Required
A newly disclosed flaw in Keycloak’s 26.7.x series lets attackers sidestep security policies. The vulnerability, identified as CVE‑2026‑90997 and tracked by GHSA-xpwp-2pcm-8xq3, is present in all releases before 26.7.4. French CERT issued an alert on 17 September 2026 urging users to update or apply the vendor’s fix to prevent unauthorized access.
Read briefing