The attacker simply place their malicious content inside or alongside legitimate services like Google Ads or Cloudflare, making the whole process appear credible.