Hackers spent $4 million of victims’ money to buy ads for diet pills, fake designer handbags, and more.