I've heard stories from other ad managers where accounts were hacked and used to advertise foreign dropship jewelery websites. The websites would get free advertising from the hacked account.
I was witness to something like this. Employee of a rather large agency I was consulting on an account with signed into a cyber cafe in a foreign country and got their FB account stolen. For reasons beyond me an agency spending a good 10mm+ a month on Facebook ads didn't have 2fa required for employees and 20k was spent on an a middle eastern dropshipping store overnight before anyone caught it.