Hackers hijack Google domains after breaching ccTLD registries

Attackers exploited weaknesses in third-party ccTLD registry operators to manipulate DNS records and fraudulently obtain HTTPS certificates for Google-owned domains — a classic supply chain attack where trust in a delegated third party becomes the attack surface. The root cause lies in insufficient security controls at these registries, which act as critical internet infrastructure but may not be held to the same security standards as the organizations whose domains they manage. This matters because even a well-secured organization like Google can have its domains impersonated through no direct fault of its own, undermining the foundational trust model of the web's certificate and DNS ecosystem. The incident highlights that certificate transparency logging and browser-level certificate blocking, while effective reactive measures, are no substitute for proactive security at every link in the DNS chain.