Was I hacked on My MacBook Pro M3

That looks like a command to download and run some arbitrary script from a remote site. It also looks like it asked for, and got, your password - to let it run with elevated privileges.

Who knows what it might have done? I would not enter such a command on my own machine. However, if you were the one who entered the command, you were not “hacked”. You compromised your own security.

D'oh! Didn't notice the date. 🫢

Which then begs the question, why bring it up now?

If the OP hasn't seen any issues with unknown purchases, bank accounts being drained, or other typical malice, then 10 months later, I wouldn't worry about it.

At least, not that part. I'll still be inclined to nuke 'n' pave to make sure anything that may have been installed is gone.

Unless the Hacker has had direct and physical contact with this computer..

They some how been able to guess your Strong Computer Password ( alpa, numeric case sensitivity password )

Then,  planted their backdoor Hacks on the computer

It is not likely the computer was Hacked 

Adware and Malware can affect computers and are often downloaded from “shady” websites or developers who inject them into downloads.

A good sources of this type of softwares are by installing Hacked Version of Third Party Software or via Torrent downloads

Source: User tip from @Kurt Lang

What is malware? - Apple Community

Even so, the macOS operating system resides in a sealed and read-only volume that can’t be opened by users or third-party applications

If you believe the computer has been compromised 

Start Over from Scratch 

Heavy Handed ?  - Yes 

Effective  ? - Yes 

For Apple Silicon computer >> Use Disk Utility to erase a Mac with Apple silicon.

Kurt Lang wrote:

As has been noted, someone sat at your computer while it was unlocked (access to the GUI desktop). Then tried to run a curl command. It appears the password 1111 didn't work as Terminal passed back, no such job.

To me, that alone isn't enough proof nothing happened. I would guess Terminal was left on the screen because whoever this was saw you coming back and didn't have time to close it. But that's just one thing. There's no telling what else this person did while they had direct access.

In context of your above

Is this significant

" Last login : Sat May 26 01:02:37 "

Would seem the Owner Account had been logged in over a year ago

Your thoughts

As has been noted, someone sat at your computer while it was unlocked (access to the GUI desktop). Then tried to run a curl command. It appears the password 1111 didn't work as Terminal passed back, no such job.

To me, that alone isn't enough proof nothing happened. I would guess Terminal was left on the screen because whoever this was saw you coming back and didn't have time to close it. But that's just one thing. There's no telling what else this person did while they had direct access.

Owl-53 wrote:

…

In context of your above

Is this significant

" Last login : Sat May 26 01:02:37 "

Would seem the Owner Account had been logged in over a year ago

Your thoughts

The following will show login activity:

sudo last

For somebody that doesn’t use Terminal often, the last login time can be antediluvian.

And per the original post, this is a “I found a video” mysteriously-appearing video file question. Not about a login occurring here. Well, not unless somebody then went and tried the commands from the video on themselves. Which could be bad.

Some background on how we got here, please? 

You’re asking about how a video file got loaded onto your local Mac? 

Or did you try executing those commands yourself, or find those commands when you accessed your Mac?

The domain specified has reportedly been associated with stuff you don’t want on your Mac.  

@MrHoffman and @Kurt Lang

Putting this question from OP in my context

I do remember about 2 - 3 years ago.

This User or someone with a very similar User name posted a similar question regarding " Has my computer been Hacked "

To which a similar response to this question was offered

Thereafter to question went Silent

Had to seek a translation for Antediluvian refers to the time period before the biblical flood described in Genesis 6-8, or more generally, anything extremely old, antiquated, or outmoded. The term stems from Latin ante (before) and diluvium (flood), coined in the 17th century to describe pre-flood conditions and later applied to ancient, primitive, or archaic items. 

My short lived early days in the seminary did not cover this term

lol

Owl-53 wrote:

Had to seek a translation for Antediluvian refers to the time period before the biblical flood described in Genesis 6-8, or more generally, anything extremely old, antiquated, or outmoded. The term stems from Latin ante (before) and diluvium (flood), coined in the 17th century to describe pre-flood conditions and later applied to ancient, primitive, or archaic items. 

My short lived early days in the seminary did not cover this term

lol

Previous postings discussing claims of hackage, I’ve seen a number of those over the years, often with similarities in text form and text contents and claims, but not any I specifically recall related to this case and this nickname.

I am aware of folks around here that were targeted and did obtain forensics and security assistance via a DFIR provider, as well. Quite rare, but it happens.

My apologies with my earlier choice of obscure verbiage. I try to constrain my sesquipedalian tendencies. 😉

trefford wrote:

ok that's good news.. I wanna thank you for replying and giving me info.. Thanks

You are welcome

So, where do you go with this added information

I’ve asked the mods to edit the domain