A brute force attack on Facebook involves using automated software or scripts to try a large number of usernames and passwords to gain access to a Facebook account. The attacker uses a list of possible passwords, which can be obtained from various sources, including dark web marketplaces or by using password cracking tools.