A Brazilian CA trusted only by Microsoft has issued a certificate for google.com

Can someone explain what could be done with that and by whom?

Whomever has this fake certificate can run a server and say it's google.com and windows will say "yep you are" with the little green lock.

The certificate is for a specific IP address, no?

And without DNS pointing google.com to that IP address, it's pretty useless.

Nope, certificates are issued for CNs(Common Name), also known as FQDNs (Fully qualified domain names). Something such as *.google.com, not IP addresses.

If they were issued for IP addresses they would have to reissue the certificate every time they spun up a new server. Also it's why if you spin up another server and make DNS point google.com to that server, it would not pass verification since the certificate you will be using on that server is not issued to *.google.com, but rather some other domain you own. The IP address plays no role in certificates.

Certificates can be issued to IP addresses (at least on SAN level, not sure if they are allowed in CN in CA/B baseline requirements), like https://crt.sh/?id=15492507462