Victims searching for SIMBA top-up services on Google were directed to phishing websites that appeared among the top sponsored search results.