In 2023, a campaign using post.php scripts circulated via Facebook Messenger. Victims received a message from a friend’s hacked account:
If you see or receive phishing attempts, report them to the platform being impersonated (e.g., Facebook's report feature) and to your email provider if you received it via email.
It allows for the easy replication of Facebook’s visual elements to make a fake site look indistinguishable from the real one. Protecting Your Account