Probably time to shut down the machine in question, clone it and do a forensics run on the clone. Use a new machine temporarily.

Obviously other vectors are possible, but in the absence of knowledge it is likely appropriate to react in a secure by default way.

Yes, this is good advice.

If I didn't know you to be tech savvy, I'd assume the most likely culprit is that your desktop had been hacked and the tweet did in fact come it.

Out of curiosity which OS and browser?

Linux, fairly well hardened, Firefox with umatrix and adblock plus.

No Javascript unless expressly authorized making some kind of drive-by browser attack quite unlikely.