Hackers are setting up fake websites for popular free and open-source software to promote malicious downloads through advertisements in Google search results.