I assumed that this meant the attackers logged into their own social network accounts while they were "inside" (i.e. using) compromised machines in the target locations.