Attackers Hijack Google Advertiser Accounts to Spread Malware

Researchers at Malwarebytes identified a large-scale malvertising campaign in which attackers impersonate Google Ads (using ads that display ads.google.com and lure pages hosted on Google Sites) to phish advertiser credentials, then immediately use compromised accounts to place malicious ads and distribute malware; Google is investigating and taking down reported ads but the operators repeatedly spin up new accounts, making the activity persistent and impactful.