A seemingly never-ending Google hacking campaign that steals account credentials is adding to the attack distribution pool in real time—what you need to know.