Yes, that message is really from Facebook. And, yes, it's really malicious.
That's a real post from our friends at KnowBe4 Security. From the post:
That's a real post from our friends at KnowBe4 Security. From the post: