Phishers can use stolen log in credentials to harvest e-mail addresses and other contact details to post spam messages advertising on the users behalf. The hard way looks like this: the worst thing for you would be to receive from your social connections blood boiling because their antivirus and/or computer just went crazy after landing on your Facebook page. The easy way: the easy way is to use the stolen log-in credentials to access and log in details stored in Facebook accounts. An IM-based spam wave sent via a spam wave.”]
Source: https://www.bitdefender.com/blog/hotforsecurity/facebook-users-beware-of-the-fake-hubs/