An attacker can pick up the profile picture, username and the “likes” of unsuspecting visitors who find themselves landing on a malicious website.