Threat actor impersonates Google via fake ad for Authenticator

Only trust official sources they say, but what happens when a Google vetted ad is for a Google product?