Phishing attack bent on stealing Facebook credentials - A bad actor was able to design a very realistic-looking social login popup prompt in HTML. When a victim visits a malicious website (which an attacker could somehow convince them to visit, using social engineering tactics or otherwise), they would be prompted to log into their Facebook account via a false login prompt Once they fill out their username and password, that information is sent to the attacker.

Once they fill out their username and password, that information is sent to the attacker.

“The only way to protect yourself from this type of attack is to actually try to drag the prompt away from the window it is currently displayed in,” he said. “If dragging it out fails (part of the popup disappears beyond the edge of the window), it’s a definite sign that the popup is fake.”

In general, as a precaution users should always drag popups away from their initial position to spot for abnormal behavior.

https://threatpost.com/sneaky-phishing-scam-facebook/141869/