From the article: The memes contain an embedded command that is parsed by the malware after it’s downloaded from the malicious Twitter account onto the victim’

From the article: The memes contain an embedded command that is parsed by the malware after it’s downloaded from the malicious Twitter account onto the victim’s machine, acting as a C&C service for the already-placed malware. It should be noted that the malware was not downloaded from Twitter and that we did not observe what specific mechanism was used to deliver the malware to its victims.