Under login items and extensions, under app background activity, the application bash says “item from unidentified developer”. I recently ran a malware scan, quarantined, and deleted macOS.stealer.macsync and wanted to see if this had anything to do with it even after deletion.
MacBook Air
I believe your device is now secure, where a Factory Reset would offer no further protection. Of course, your passwords should be changed as that is what that Malware is looking for and it is not clear if it was allowed to run the bash script or not to send those passwords to a third party.
I believe the Malware was inadvertently installed on 6/26/26 and would have required your Mac login password to install. It could have been from a fake "Flash Player Update" notification or another source where you were required to enter your login password for your Mac. It looks like the file was represented as com.apple.accountsd.plist in your Launch Daemons folder, and the report provided shows that it was not allowed to be loaded, so it is possible that it never was allowed to run that bash script at all. I would change important passwords pertaining to your Apple Account or Financial accounts just to be safe.
Remove all files listed as Not Signed. That includes that Google Keystone files and the Microsoft Teams launch files. If you need Teams, just install it again from a Trusted Source and the install is expected to be Signed. The one that appears as "apple" should not be there and is suspicious. For each of these Folders, go to the Finder and choose the Go menu, then the Go to Folder option. Copy/Paste each location in the box there and delete those filed. Don't forget the "~" character at the start of the last one.
/Library/LaunchDaemons
/Library/LaunchAgents
~/Library/LaunchAgents
On a side note, your drive performance is not very good. This is most likely due to the multiple syncing services (Box, Google Drive, OneDrive, and Adobe Sync) that are competing against each other syncing/indexing your drive when it could be performing other operations. As long as you are not seeing beach-balling or it is not having an effect on your user experience with slowness in the UI, I would not worry too much about it. If it is, that is where you want to look to pair down your syncing options.
Objective-See BlockBlock has crashed 2 times today and noted as being one of your top Energy users. That would be something the Developer would have to address, or you could uninstall that software.
You can post the free EtreCheck report using the Additional Text option when posting. The report contains no personal information.
How to use the Add Text Feature When Post… - Apple Community
Any process noted as "Not Signed" should be removed.
Ok I removed the unsigned files, and the bash that said “item from unidentified developer” is gone now under app background activity on Login Items and Extensions. Just to be clear, I should be okay or do I need to factory reset after removing the unsigned files?
Removing background activity from unidentified app
