>Searching Google's ad archive (Ads Transparency Center) for the domains in our first sweep found at least 47 Google Search text ads between July 7, 2026, and October 20, 2026, run under at least 46 separate advertiser accounts with at least 43 different, unrelated-looking business names

And yet Google says sideloading is where users are getting hijacked. FFS

The hackers should pass on the order to the real restaurant to reduce suspicion.

>Google's public Ads Transparency pages now show "Can't find ad" for the creatives and "No ads found" for the domains we checked, which suggests Google has taken them down

So much for transparency, removing evidence that Google served ads on these impersonating domains