How to avoid Facebook scams?
The hijacking could have happened in the tiny window the ad opened at first. Beth Jones, a researcher with the security firm Sophos, explained that con artists can use JavaScript tricks to hide links in part of or all of a page -- for example, turning it into a giant "Like" button.
Source:usatoday