I believe OP meant that the attackers got access to the account by hacking SMS, thus getting the verification code and legitimately logging in the accounts.

I meant in the sense of SIM-swap hacks, though SMS-posting would also make sense as a vector (had Twitter not recently ended it)

https://info.phishlabs.com/blog/sim-swap-attacks-two-factor-...