Most people know at this point that when searching for a popular software package to download, you should be very careful to avoid clicking on any of the search ads that appear, as this has become an extremely common vector for distributing malware to unsuspecting users.
If you thought that you could identify these malicious ads by checking the URL below the ad to see if it directs to the legitimate site, think again! Malware advertisers have found a way to use Google's Ad platform to fake the URL shown with the ad to make it appear like a legitimate ad for the product when in fact, clicking the ad will redirect to an attacker controlled site serving malware.
Don't click on search ads or, even better, use an ad-blocker so that you never see them in the first place!
Businesses should not be allowed to serve ads from random people without curating/checking them first. Yeah it would be a lot of trouble and cost a lot of money, too fucking bad you are making billions of dollars off this.
This has been a feature of Google Ads forever. It isn't even "found a way" it is just a box to fill in the ad manager.
Presumably this is so that they can use tracking links to analyze the performance of the ad without making the URL "ugly". But it is easy to abuse. (Although I think Google attempts to do some checks, but of course those are always going to be unreliable.)
At least not without an ad blocker. I never see these ads, but if I did I would initially assume they were generally safe being served by Google and right at the top of the search results. There is no excuse for this, yes users need to be careful but Google should never serve this deceptive crap to begin with.
AFAIK even legitimate ad clicks will first direct to an analytics platform before redirecting to the destination site, so that they can track click through rates and where the referral came from. So it is unlikely that ad links will actually go to the website you expect them to even in normal scenarios. It is actually this mechanism that the malicious ads described in the article are using to fake the display URL.
I would always out of habit avoid any links that go to somewhere other than the advertised destination - so if it goes to an analytics platform I would copy and paste the text if the text of the link is a URL, or find an alternative. Always hovering links and being absolutely sure of where they go should really be taught as standard practice.
I always check the status bar but I actually noticed the other day on LinkedIn or maybe Facebook, that the status bar said one thing, but the link was different,
Had this happen searching for Argos (a large British retailer). The sponsored result sent me to a survey scam that cloned the Argos site, quickly reported it.