- The big problem is that malicious ads are being displayed without appropriate attribution

- Add that attribution -- blame Google (or, supposing the ads are good, credit Google; a good header goes a long way toward swaying people's opinions)

- But it doesn't matter if a single website appropriately attributes Google's highest/lowest-quality ads. The last step (speculative and hand-wavy) is to incorporate that behaviour in some sort of software more people want to use. If you're fighting alone then you'll lose. If you can convince more people that appropriately crediting Google's advertising successes and blaming their malicious failures is advantageous, you'll (by definition) have more traction in the anti-megacorp-endorsed scams and other life-altering consequences.

The second you load JS onto your page, you lose that ability, you know that, right? the scammy ads aren't limited to that tiny little box you designate for ads. Advertisers work around that limitation pretty easily, and you should also probably read AdSense terms of service before doing too much to blame google. Some of the language will surprise you.