Phishing scam via Google search ads stole over $4M from users