This question already has an answer here:
"The DNSChanger Trojan replaces the name servers with their own in order to direct web and other requests from the infected host to a set of attacker-controlled servers that can intercept, inspect, and modify the infected host traffic."
My question is how can attacker phished a site which using CA certificate? After successfully changing of DNS Address - if victim visits https://www.google.com then s/he will see
a message saying that
connection with site is not secure and other warning message in browser. Is there any way to bypass it?