Facebook expands security to thwart phishing attack