Yes, that message is really from Facebook. And, yes, it's really malicious.

That's a real post from our friends at KnowBe4 Security.  From the post: