thank you all for commenting .
I’ve Installed No-Script , the problem is , you must allow script on facebook , or else you will not be able to use it!
thanks in advance.
*I hided my mail , I thought it will be hidden by default .
**I’ll send the link to avast team , so they can make an anti for it , and maybe they know the pattern and make some update to stop this method for future attacks.