Nothing new...

15 years ago when MSN was existing i saw script with "login prompt" to share something important with your MSN buddies. Once user login - script dump his username/password to DB, login on MSN and share same text to all his buddies about game.

Of course link leading to same login prompt and least one buddy click on it and login.

So was easy to reproduce that even in Facebook using token of logged user.