@securestep9
The threat actor here is Google attacking Google on the Google platform (and causing harm to all of us). There's no reason why ads should be allowed to show fake URLs in a UI designed to resemble organic search results. NO FUCKING REASON.
Then, mouse-over doesn't help, because it's google.com.
Then, the redirect to github would raise a red flag, but does not because so many ads do this. And not only ads.
I agree that Google policies have created this attack vector. Looking at the Ads URL policies at https://support.google.com/google-ads/answer/6246601/ it looks like the display domain must == the landing page domain, so they're not directly showing fake URLs...
But Google famously doesn't consider open redirects as vulnerabilities (https://bughunters.google.com/learn/invalid-reports/web-platform/navigation/6680364896223232/open-redirectors) so I'm guessing this actor is using one of the many Google open redirects to forward from their landing page URL on google.com to their malicious domain.
Sam Stepanyan 
🐘
J
0xceba