Federal prosecutors say criminals bought sponsored search ads mimicking real banks, capturing over 5,000 login credentials and draining accounts.