All advertisers and businesses are suffering as a result of this phenomenon. You are not alone.
Bots are programmed to click on ads in order to drain advertising budgets and cause major financial loss to companies who use all sorts of advertising formats, from Search to Display, from Pop to Push.
Even Google, with their advanced anti fraud systems, can't block all the bots because of the fact that malicious bots are using Headless browsers. Headless browsers such as Headless Chrome were originally designed for development companies to run tests efficiently, as this version of the browser has no interface, it's fully automated and is identical to a real visitor's browser.
Most systems and websites have no ability to distinguish between real visitors and fakes anymore.
These bots crawl and map many parts of the internet, much like Google does, and they do it from personal IPs as well (installed as malware on people's PCs), making IP blocking not very effective.
The direct result of this craze is a significant inflation of click costs and customer acquisition costs.
What can you do about it?
Monitor the activity on your website and flag specific clicks that are transferred via the GCLID of FBCLID (for Facebook) parameter, then, report these clicks to your advertising platform. You will not receive all the money back for ALL the clicks, but you should have some of it back.