Malvertising targets Google Ads users, redirecting to phishing sites that steal credentials, budgets, and 2FA codes.