Timing is good on this one: https://arstechnica.com/information-technology/2019/02/behold-the-facebook-phishing-scam-that-could-dupe-even-vigilant-users/ https:

Timing is good on this one: https://arstechnica.com/information-technology/2019/02/behold-the-facebook-phishing-scam-that-could-dupe-even-vigilant-users/ https://arstechnica.com/information-technology/2019/02/behol... I didn't investigate in detail but it appears that it is a fake iframe. Even X-Frame-Options et al to prevent 3rd party iframe doesn't solve it because the iframe is fake to begin with! Very very hard for you to prevent copy/paste to a fake iframe SSO.