In short, whoever has that certificate can now come between your PC and the real Google, and tell your PC "here is the real google.com" while serving you malwar

In short, whoever has that certificate can now come between your PC and the real Google, and tell your PC "here is the real google.com" while serving you malware, in a way that Windows will trust. You typed in google.com in the address bar, your browser got the attacker's IP, and then the attacker has a certificate that says they're the real google.com, so your browser will go "all right, all good". Basically the way certificates work is that whoever has a certificate for a domain name will be able to serve anything they want and browsers will accept this is the real domain. To turn this into an attack, they just need to trick your DNS into pointing your to their machine, or to intercept your traffic even while you're accessing the real server. Getting a certificate for "mytotallyrealnotascamwinkwink.phishing.com" is not useful in any way for an attacker: the whole idea is to have the user think they are on a trusted site like google.com, while in reality looking at the attacker's site.