Ghana (Country): news timeline & CVEs

Attackers hijack country-code domains to impersonate Google and other services

Attackers hijacked .gh, .sl, and .as DNS to get certificates impersonating Google and others.

Google said attackers compromised infrastructure behind the .gh, .sl, and .as country-code domains and used DNS control to pass validation and obtain trusted HTTPS certificates for Google domains and other organizations. Google's own systems were not compromised and encryption was not broken, but valid certificates plus traffic redirection could impersonate legitimate services. Google blocked unauthorized certificates in Chrome, worked with certificate authorities to revoke them, and later blocked suspicious certificates for other organizations. It warned the review may have missed domains and that Chrome interventions do not reliably protect non-Chrome users.

Malwarebytes Labs15:53 UTC · 6h agoPhishing & fraud in the wild 10 sources

Attackers Hijack Three ccTLDs to Obtain Google Certificates

Attackers hijacked the .gh, .sl, and .as registries and obtained unauthorized certificates covering Google domains.

Google's Chrome team said attackers compromised the .gh, .sl, and .as country-code registries, changed authoritative DNS records, and obtained unauthorized HTTPS certificates for Google domains and other organizations. Google said its own systems were not compromised and it had no reason to believe the issuing certificate authorities acted improperly. Chrome blocked the rogue Google certificates through CRLSets, and Google worked with the CAs to revoke them after Certificate Transparency logs showed additional affected brands. Google urged owners to monitor CT logs and set restrictive CAA records with ACME account bindings, while noting CAA cannot stop issuance during an active DNS hijack.

Infosecurity Magazineupdated 15:53 UTC · 6h agofirst 14:30 UTC · 8h agoData breach in the wild 10 sources

FBI Dismantles Scam Center in Ghana and Seizes 300+ Devices in Operation Blackout

FBI’s Operation Blackout raided a Ghana scam center, seizing 300-plus devices after nearly $10 million in losses.

The FBI dismantled a Ghana scam center under Operation Blackout, identifying 89 victims and seizing more than 300 devices. Director Kash Patel said the action found nearly $10 million in losses and that more than 130 people were arrested or detained, including trafficking victims to be repatriated. The wider campaign uses romance and fake-investment schemes through social media, calls, texts, and Telegram, often via cryptocurrency platforms. Patel’s roughly $17 billion campaign total is separate from the Ghana figures, and the investigation remains ongoing.

Cyber Security News14:08 UTC · 8h agoPhishing & fraud

Attackers Hijack .gh, .sl, and .as Domains to Obtain Unauthorized SSL Certificates

Attackers hijacked .gh, .sl, and .as DNS to obtain unauthorized TLS certificates for Google and other organizations.

Chrome's Secure Web and Networking team disclosed on October 6, 2026 that attackers compromised authoritative DNS for the Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as) country-code domains. By changing DNS records, they passed certificate domain validation and obtained unauthorized HTTPS certificates for Google properties and later other organizations, without breaching Google itself. Google blocked the certificates in Chrome using CRLSets and worked with the issuing authorities to revoke them. The report does not name the attackers, list every affected domain, or say whether the certificates were used to intercept traffic.

GBHackersupdated 15:53 UTC · 6h agofirst 07:46 UTC · 14h agoData breach in the wild 10 sources

Hackers hijack Google domains after breaching ccTLD registries

Attackers breached .gh, .sl, and .as operators, hijacked DNS, and obtained TLS certificates for Google and others.

Attackers breached third-party operators of the Ghana (.gh), Sierra Leone (.sl), and American Samoa (.as) ccTLD registries and changed authoritative DNS records. That control let them obtain valid HTTPS certificates and point affected domains, including several Google domains and other major brands, at attacker infrastructure. Google said its own systems were not compromised and that the issuing certificate authorities did not act improperly. Chrome blocked the unauthorized certificates through CRLSets, but Google warned the lists may be incomplete and do not protect non-Chrome users.

BleepingComputerupdated 15:53 UTC · 6h agofirst Oct 7, 20:50 UTC · 1d agoData breach in the wild 10 sources1

Attackers hijacked top-level domains, minted fake security certs for Google and other orgs

Attackers hijacked .gh, .sl, and .as domains and minted fraudulent certificates for Google.

Google said attackers hijacked the .gh, .sl, and .as country-code top-level domains, changed authoritative DNS records, and obtained unauthorized HTTPS certificates covering several Google domains and domains of other organizations. Google's systems were not compromised, and the company said the certificate authorities that issued the certificates did nothing wrong. Chrome blocked suspected counterfeit certificates for the affected ccTLDs, but Google warned that protection may not cover every domain or non-Chrome users. It recommended Certificate Transparency monitoring and restrictive CAA records so attackers cannot keep issuing certificates after DNS control is restored.

The Register · Securityupdated 15:53 UTC · 6h agofirst Oct 7, 19:38 UTC · 1d agoThreat actor in the wild 10 sources

Attackers Hijack .gh, .sl, and .as Registries to Obtain Certificates for Google Domains

Attackers hijacked the .gh, .sl, and .as registries and obtained later-revoked HTTPS certificates for Google and YouTube domains.

Google said on October 6 that attackers compromised the .gh, .sl, and .as country-code registries and obtained unauthorized HTTPS certificates for Google and YouTube names, without breaching Google's own systems. Certificate Transparency logs show 12 domain-validated certificates, 11 from Let's Encrypt and one from ZeroSSL, logged between September 22 and 27 for names including google.com.gh, google.sl, and google.as. Chrome blocked the Google certificates via CRLSets, the issuing certificate authorities revoked all 12, and Google said the same DNS hijacks appear to have hit other unnamed organizations. Google did not confirm the certificates were used to intercept traffic and did not name the attackers.

The Hacker Newsupdated 15:53 UTC · 6h agofirst Oct 7, 18:48 UTC · 1d agoData breach in the wild 10 sources

Hackers Hijack .gh, .sl and .as Registry to Obtain Unauthorized HTTPS Certificates

Attackers hijacked .gh, .sl, and .as registries to obtain unauthorized TLS certificates for Google and others.

Google disclosed that attackers compromised the .gh, .sl, and .as country-code registries for Ghana, Sierra Leone, and American Samoa. By changing authoritative DNS records, they passed domain-control validation and obtained unauthorized HTTPS certificates for Google and other organizations. Google said its systems were not breached and the issuing certificate authorities were not at fault. Chrome blocked identified certificates through CRLSets, Google arranged revocations, and it warned the review may not have found every affected domain.

Cyber Security Newsupdated 15:53 UTC · 6h agofirst Oct 7, 15:39 UTC · 1d agoData breach in the wild 10 sources

Hackers hijack three country-code domain registries, obtain HTTPS certificates for Google domains

Attackers hijacked Ghana, Sierra Leone, and American Samoa domain registries and obtained HTTPS certificates for Google domains.

Google said attackers compromised the third-party operators of the .gh, .sl, and .as country-code registries, then changed authoritative DNS records. That access was used to obtain HTTPS certificates for several Google domains and domains run by other large organizations. Google said its own systems were not compromised and that the issuing certificate authorities did not act improperly. Chrome blocked the certificates through CRLSets, the CAs revoked them, and Google warned that other affected domains may remain unidentified.

Help Net Securityupdated 15:53 UTC · 6h agofirst Oct 7, 11:10 UTC · 1d agoData breach in the wild 10 sources2· 1 read

Chrome's Response to Recent ccTLD Registry Hijacks

Attackers hijacked .gh, .sl, and .as registries, issuing unauthorized certificates for Google and other brands.

Google said attackers compromised the .gh, .sl, and .as country-code domain registries and changed authoritative DNS records. The hijacks did not involve Google's own systems, but attackers obtained unauthorized HTTPS certificates for several Google domains and for other organizations. Chrome blocked the suspect certificates with CRLSets, and Google worked with issuing certificate authorities to revoke them. Google said the authorities were not at fault and advised domain owners to monitor Certificate Transparency logs and publish restrictive CAA records, including ACME account bindings.

Lobsters · securityupdated 15:53 UTC · 6h agofirst Oct 6, 18:00 UTC · 2d agoData breach in the wild 10 sources1

Breeze Comet Executes Hundreds of Fraudulent Transactions via Brazilian Payment Systems

Google/Mandiant profile Breeze Comet, a Brazil-based e-crime group executing fraudulent Pix and STR payment transactions at banks, retailers, and fintechs.

Google Threat Intelligence Group and Mandiant describe Breeze Comet (formerly UNC5669), a financially motivated threat actor active since September 2023 targeting Brazilian financial services, retail, and e-commerce. The group gains access via password spraying, vishing impersonating IT support to install RMM tools like AnyDesk, WhatsApp social engineering, and exploitation of vulnerable JBoss AS servers for web shell deployment. It uses compromised government websites as C2, deploys the Rust-based COBALTSPIN tunneler and multiple custom backdoors (LIGHTPAINT, MILDFROST, KICKPLATE, BOATBEAM), then clears logs after executing hundreds of fraudulent transactions through Pix, STR, and Boleto payment systems. At least one heist yielded tens of thousands of dollars, with infrastructure suggesting expansion toward Latin America and Africa.

The Hacker NewsSep 8, 11:22 UTC · Sep 8, 2026Threat actor in the wild

Ghana

Timeline11 articles

Appears with