Clicked a "watch party" invite for the Champions League final from a friend's Discord account — within 30 seconds my session token was stolen and the same invite was going out to everyone on my friend list