Would like more in on WebKit notifications and json file on iPhone

It's going to be a bit difficult to sort out all of your isssues and questions here, but a bit of information:

WebKit is not a retail product as such. It's a core development environment and set of software code, used as the core of the Safari web browser and other applications that need to access the Web. It was originally developed by Apple and they contribute to the project, but it's open and available for other developers to use. So there could be a number of apps that might report to an Internet provider as coming from "WebKit".

I'd guess that the JSON file is a leftover from an app such as Minecraft. If it's on iCloud Drive, I'd guess that it was a part of a game that was moved from an iPhone when the device was set to move unused apps to iCloud to save space on the iPhone. But I have no way of knowing for certain.

As to issues with compromised accounts, that's not going to be an issue with your iPhone. Accounts are much more likely to compromised due to a scam that managed to extract personal account information from you, your son, or someone else with knowledge of your account information. You'll need to continue to work with the companies with whom you have accounts to deal with those problems. This information may help you try to recognize any such scams in the future:

Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams - Apple Support

Regards.

I know you didn't ask me, but I will tell you YES, you should be using two factor authentication EVERYWHERE you possibly can. I use it for my Apple ID, my banking and credit card apps, my cellular account and any other service which offers the option.

The AT&T message is perfectly normal. That's now most two-factor authentication systems work, you log in on their site and then they send some sort of request for confirmation to the cellphone number or email address you have registered with them. As lobsterghost said, you should have two-factor authentication set up on any financial accounts, Social Security, or anything else that holds highly sensitive data. Many such sites now actually require it.

The one purporting to be from McAfee is suspicious, unless you were talking with McAfee support (and you had called them directly for support rather than responding to some unsolicited popup, email or text you may have received offering help) and they instructed you to send those logs.

Regards.

This is a really good answer! I don't vote often, but you got an upvote from me!

Thanks, LG. I hope it helps.