Hackers hijack verified streaming account to spread malware, researchers find

Web and API vulnerabilities like this are exactly what manual penetration testing is designed to catch — automated scanners routinely miss the logic flaws and chained issues that cause the most damage in practice.