malware

That depends on details of the situation not yet known, on your value as a target past the keyloggers, and on how the keyloggers can to be installed, and who—if you have suspicions or if you might know—might have installed the keyloggers.

Also around whether the police might be engaged, among other details.

The system installs, the local network configuration, pretty much everything here is headed for a full reset and reload, and for new passwords on everything everywhere.

Also what the motives might be, and what data might have been or was exposed.

Checklist: If you want to see if anyone else has access to your device or accounts - Apple Support

Checklist: If you want to make sure no one else can see your location - Apple Support

Checklist: If you want to stop sharing with someone whom you previously shared with - Apple Support

If you think your Apple ID has been compromised - Apple Support

Nick Isaacs wrote:

I use Malware protection on both computers, VPN and don’t open suspect emails. What else am I doing wrong?

Ah, okay, then there may be nothing wrong here.

VPN add-ons can be trouble, as can add-on anti-malware.

VPN add-ons arguably don’t provide what most folks think they provide.

And this wouldn’t be the first false-positive from add-on anti-malware.

If got "installed" then you allowed it.

Software can not be remotely enabled on your Mac.

Let me think. OK. Got it.

Running malware protection software (whatever that is) and using a VPN could both be the cause.

Your Mac doesn't need them and they make it even less secure.