The great Google Ads heist: criminals ransack advertiser accounts via fake Google ads

Malwarebytes documents an active, large-scale phishing campaign dubbed the “Google Ads heist” in which attackers use fraudulent Google Ads and Google Sites landing pages to phish Google account credentials, take over advertiser accounts, drain ad budgets or resell accounts; the report identifies multiple actor clusters (Brazilian Portuguese-speaking, Asia-based, and a third group), outlines their delivery and cloaking techniques, and lists many phishing domains and compromised Google Sites IOCs.