System Hacked, need to secure.

PRP_53's comments are valid in this case, whether or not, you agree. The key is someone would have to have physical access to this computer for it to be possible for it to be "hacked."

At this point, there are three "next steps" that I suggest you take:

1. As tbirdvet has suggested, completely erase your Mac's internal drive, and then, reinstall a fresh copy of macOS. Whether or not, you restore from a backup is questionable if that latest backup was recent. That is because, it may have been "infected" by the "hacker."
2. Once you have a fresh macOS installed, go through the process of "hardening" your Mac. Some examples are: Enabling a firmware password (Intel-only,) enabling FileVault, do not create more user accounts than absolutely necessary, use secure passwords and change them periodically, and be sure to keep this Mac running the very latest version of macOS.
3. Do not let this Mac be used by anyone, other than yourself. When not in use, know where it is at all times. If you can, lock it in a secure location when you are not around.

We have no clue on how this happened. Only that you claim that it has. We can only make assumptions as to what happened and offer reasonable "next step" ideas.

Ref:

• macOS - Security - Apple
• Apple Platform Security - Apple Support
• Protect data on your Mac with FileVault - Apple Support
• Why you should enable FileVault - The Eclectic Light Company
• Set a firmware password on your Mac - Apple Support

I would guess that if it is true what you have stated I would assume someone has installed some software to control your Mac. You may have brought this home from work. I would boot into recovery, erase the drive, reinstall the OS then migrate from your backup from a time before all this took place. This will not happen again unless you have had some interface with those individuals or companies. The Mac OS itself is very secure against hackers or viruses.

Screen sharing should not be a risk, but as BobTheFisherman has mentioned, be vigilant of what you are sharing.

As far as connecting to a company's Wi-Fi, the company, of course, should be responsible for providing a secure network for you to connect to. Some companies only allow for non-employees to connect to a "guest" network with only the ability to access the Internet and not to company resources. Not sure that is the case here or not.

A few things you can do to lower risk, is to:

• Either use a Guest account on your Mac or create a new user account solely to be used for accessing the company's network. Then completely delete this account when it is no longer needed.
• Enable the software firewall on your Mac to block all incoming connections (as you previously did in one of the images you provided.)
• Only stay connected to the company network as required.
• Do not allow anyone access to your Mac.

OK, I understand. Let me be blunt, though...

1. You don't have the technical skills needed to do this - certainly not to the level needed for "proof". If you don't trust the in-house IT (and assuming this is university level academia), you probably need an IT security researcher from the Computer Science or Computer Engineering departments.
2. If you actually think the in-house IT is untrustworthy (or worse, if they actually are), then your organization has a bigger problem...
3. In any case, in most jurisdictions around the world, unauthorized access to a computer is a criminal offence - so you always have the option of the police.

In any case, pursuing this yourself is the wrong way to go. If nothing else, any "proof" you find will be suspect because you are also the victim and no administrative process worth its salt will accept it (let alone any criminal legal process).

" Hackers " would have needed Direct Physical Access to this computer

Then, to have somehow been able to Guess the Computer Password in order to have gained access to the Owner / Admin account of the computer

Thereafter, to have planted their " Hacking Software " on this computer

Added, If FileVault were enabled on this computer

Without the Admin Account Password of this computer, it would be virtually impossible to gain access to the computer

Solution ?

Would to understand, your words, “Hacker “ is and how they would need access to the machine

Unknown external user your words took control of . . .

You may have invited a hacker- like software namely How do I uninstall Antivirus One from my … - Apple Community

Which in and of itself it totally useless

Windows-like viruses that self-replicate and affect macOS don’t exist because of the underlying UNIX Foundation and permission limitations.

The macOS operating system resides in a sealed and read-only volume that can’t be opened by users or third-party applications.

This antivirus software only protects the developers’ bank accounts and creates problems for users in return.

Mac app security enhancements are sufficient to protect computers from malware.

Adware and malware can affect computers and are often downloaded from “shady” websites or developers who inject them into downloads.

Source: User tip from @Kurt Lang

What is malware? - Apple Community

There's very little information being provided to allow any kind of useful advice - beyond the generic advice you've been given already. You say various things "are not ruled out" (by whom?) but what has been "ruled in"? You say there were confirmed, witnessed sessions of you screen being controlled - was this by you personally? Because if so, some detail on what you saw and why you believe this indicated external control would be helpful...

Honestly, there is a bit of an irreconcilable dichotomy between "a hacker good enough to access and escalate access" and "a hacker clumsy enough to obviously screen control in a live session".

Who is doing the troubleshooting on this? Your work IT security people? Because they should have decent resources at their disposal - or do you not trust them?

The screenshots you posted seem to indicate you are involved in academia or some kind of corporate training. IT security in academia is uniformly terrible - especially because those environments are almost always Windows Active Directory environments that are deliberately poorly configured because "academic freedom for research purposes". If there is a hacker, it might not be on your computer (although these days I'd be more worried about ransomware in academia or industry).

👍 and thank you

Sharing your screen on a TV is not a security risk. Unless of course you are exposing login credentials while sharing the screen.