Fake Claude Code installer malware used Google Ads to place spoofed AI tool pages above real documentation since March 2026.