What is process cfprefsd in Activity Monitor?

For the record, cfprefsd is a fundamental part of the MacOS operating system. It's a tool developers use when they write their application, and allows an application to read/write/modify preferences files (like files ending in .plist, and others). MacOS couldn't work without it.

So the more relevant question is which specific application is calling on cfprefsd to do something on it's behalf. This becomes a unix/MacOS lesson, about what unix utilities are at your disposal to look at the inner workings of applications as they run and interact with MacOS. For example, look at the command line tool called "fs_usage", it's one of many tools. Activity Monitor has some tools as well. But be prepared to have to learn loads about how unix-based OS's work to make sense of it.

So in summary, seeing cfprefsd in Activity Monitor is normal, as just about any app could be interacting with it. If a hacker was trying to get in to your system, they wouldn't be leaving around obvious traces like preference files...

More references:

https://developer.apple.com/library/mac/documentation/Darwin/Reference/ManPages/ man8/cfprefsd.8.html

Which leads to this:

https://developer.apple.com/library/mac/documentation/CoreFoundation/Reference/C FPreferencesUtils/index.html