Comment by danielhua

He had a Facebook ads account with PayPal linked, and the hacker used his login info to run their own (apparently Vietnamese aluminum product) ad campaign and spend using his account.