My hunch is that this was partly an inside job. The "fake job interview" and "mistakenly downloaded trojaned homebrew" stories are to give plausible deniability. But they're not very plausible imho.
A very recent one wanted me to download an executable which was to "stop me from cheating with AI", which was clearly fake. I've had plenty of interviews where I was expected to clone, fix, and run a repo, which as far as I can tell, all were from legitimate companies. An illegitimate company could easy do the same process with malware.