It sounds like they are going after a vulnerability in the browser. My guess would be that do a man-in-the-middle attack where they have a device that acts as a proxy so you get YOUR Facebook page, but with an exploit injected into the code.