My guess would be either a MITM auth capture, rootkit inject or someone (even a nation state) trying to attribute sources of illicit facebook ads/posts to unsu

My guess would be either a MITM auth capture, rootkit inject or someone (even a nation state) trying to attribute sources of illicit facebook ads/posts to unsuspecting citizens. I would not touch that with a 10 foot pole.