Do I understand this correctly, then, that this was some sort of MITM attack where valid requests to the multisig parties were replaced by malicious code while still appearing to be valid to the signers? That must be an inside job.

I have no idea. I guess they'll release a lot more info regarding this in the next few days.

And this is the first time I have heard the word “musked” in this context…

I think his English isn't good looking at the rest of the message. Might be "masked" instead.