My project has been having fake ads bought on Google to serve malware for a year now and Google doesn't seem to care. At best they might take down one ad, but there are always more.
If you're in the US[1] you can trademark your project name, and then Google will pay attention. Of course getting a trademark isn't that easy either so the solution may be worse than the problem.
[1] Back when I worked in the business this was only possible in the US, for legal reasons I didn't fully understand.