It uses Google Ads spread infostealers.