Google Security disclosed that threat actors compromised country code top-level domain (ccTLD) registries for Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as) between September 22 and 27, 2026. The attackers modified authoritative DNS records to fraudulently obtain 32 unauthorized wildcard TLS/HTTPS certificates from Let's Encrypt, ZeroSSL, and Cloudflare to impersonate major brands including Google and YouTube. Google Chrome immediately blocked the invalid certificates, and Certificate Authorities have since revoked all impacted credentials.