the attackers bought a google ad for British Airways that is shown in the search results before the actual google result for the airline, presumably so that google’s known ip checker doesn’t flag that something’s off. the sponsored results section of google blends in very inconspicuously with the actual search results
the links on the ad direct to BA’s bonafide website, but if you happened to have clicked the “contact us” card, it would take you to their FAQ page with a search parameter injected in that includes a fake phone number