Bad actors are paying for Google ads to install bogus version of Oh My Zsh

Not just "Oh My Zsh" but pretty much any piece of software. Try searching for "vlc" or "filezilla" or something and I can pretty much guarantee that the "sponsored" links are viruses/malware. I remember once having to show my boss that the "filezilla" link he was going to click on from Google was fake/malicious.

Kind of amazed by the URL shown in the ad:

  https://ohmyz.sh›app/download>lauralen.com

lauralen.com appears to be entirely AI-generated. But the presentation in the ad sure looks like the legitimate https://ohmyz.sh/ - I knew it was a scam yet I still got confused.

I've never purchased an ad - does Google let you enter custom display text for your URL? Or is there some more sophisticated trickery here? (e.g weird unicode in a header or something) Either way, what a mess.