They create a fake login screen. You enter your info, and they steal your credentials.
Facebook has implemented various security measures to prevent exploits, including: programa para hackear facebook xploit