A Facebook vulnerability that allowed an attacker to replace the comment identifier parameter attached to each web/mobile Facebook comment with an identifier reserved for embedded plugins usually located on third-party websites. The code responsible for the vulnerability is filled with strings and variable names in the Spanish language, suggesting that whoever wrote it is not necessarily part of the Turkish-speaking group. Facebook has now fixed the issue and blocked the vulnerability that was a key feature in spreading the malware. The report did not address the issue of lateral movement because Kaspersky Lab researchers were still investigating it.”]
Source: https://securelist.com/facebook-malware-the-missing-piece/75476/