Since Facebook uses SSL for authorization, an educated guess would be that they somehow intercepted the homepage of Facebook (which is not SSL-encrypted), and replaced with a phishing web page.