The easiest, least specialized route would be for them to simply buy the account credentials. Socks5 residential proxies are similarly sold in the same place.

The easiest, least specialized route would be for them to simply buy the account credentials. Socks5 residential proxies are similarly sold in the same place. As are password dumps. In the case of password reuse, I believe Twitter may still provide a way to find users by email address. Therefore, if the user's email and password are known, then the user's Twitter account can be found. From there a login can be attempted. There could also be a malicious mobile app for account hijacking. Regardless, they could most probably buy the Twitter accounts.