There's a fake BlueWallet site at the top of Google search right now

My buddy lost his BTC yesterday. He Googled "BlueWallet download", clicked the first result (sponsored), and installed what looked like the real thing. It was a clone. His seed phrase was exfiltrated before he realized.

Has anyone else seen this? Google is apparently still serving the ad. How do you verify wallet apps before installing?