I believe it would work as follows. - User wants to create a new account at website.com - website.com has been compromised to inject the attackers facebook lo

I believe it would work as follows. - User wants to create a new account at website.com - website.com has been compromised to inject the attackers facebook login - User chooses to create an account by linking with facebook. They click Link with Facebook and are redirected back to website.com logged into their new account - Attacker can now access User's account on website.com by logging in with the injected facebook credentials It seems like the attacker would need to somehow generate a unique facebook login for each exploited user though. I think if you try to "connect with facebook" with a website that already has an account for the facebook login it often logs you in rather then creates an additional account.