A rogue Facebook application has been detected that sends users to a credential-harvesting site.