MAC - Terminal Commands History - am I being Hacked??

I would say yes.

The

337 sudo dscl . create /Users/hiddenuser IsHidden 0

is the biggest clue.

I would backup your system (2 backups are better, with 2 different destination devices, using 2 different backup utilities, as Murphy's Law doesn't care if Santa thinks you have been Good this year 🙂 )

Do a factory reset of your Mac.

<How to reinstall macOS - Apple Support>

Restore your data, but be careful about using Migration Assistant, you do not want to restore the hiddenuser account.

You might be better mounting one of the backup drives, and just dragging your data from the backup drive to your system.

To identify the hidden account, you might find something useful in either of these two threads:

http://apple.stackexchange.com/questions/29874/how-can-i-list-all-user-accounts- in-the-terminal

how to find hidden accounts

I'd suggest you forget about trying to identify the person who did this. People who are smart enough to modify a Mac like this are unlikely to leave their own name on the system depending on what their aim is. You may simply cause hostility amongst your flatmates if you make the wrong accusation. I suspect your living situation needs to change but that is not the kind of thing you consult the internet for help with.

I doubt a forensics expert can track down who did it either, especially as there are multiple suspects that could have accessed the Mac. Physical access to any computer is a major security weakness.

It is clear that this user also knows your admin password (otherwise sudo commands would fail). So you have exposed your admin password somehow - a terrible idea.

Frankly the only way to prevent this happening again is to use File vault or to keep the Mac in your possession at all times. Simply reinstalling and putting a new user password is not enough - this person is probably capable enough to defeat a standard user account password.

Use FileVault to encrypt the startup disk on your Mac - Apple Support

File vault will cause all of the data on disk to be encrypted with a password that is separate to the user account passwords. That will prevent someone simply editing the system from recovery mode etc.

You also need to shutdown when leaving the machine unattended, otherwise there may be other attacks that can get around File vault (no system is 100% flawless, especially on 'consumer grade' hardware & software).

You can find third party software to take photos on login but the user may be accessing the Mac via the internet or network now they have user account setup. Your priority is to either stop using the Mac (to preserve evidence for any criminal/ legal advice) or to get a clean OS installed without the unwanted modifications.

I'm afraid that you may simply risk damaging your own data if you try to fix this manually. Editing user accounts via Terminal is tricky - do you have a backup yet?

You might want to change your user password and make sure it is a strong password. I would suggest that when you are away from your computer, you log out. If you want to let the computer sleep instead of logging out, try going to System Preferences/Security & Privacy/General and check Require password immediately after sleep or screen saver begins.

User Password Reset (2)

Not sure how much it will reveal in this situation, but every so often just enter "who" (no quotes) in Terminal. See what comes up. This will display who is currently logged in, yourself and whoever else. But you may only get something obfuscated or "hidden user" and you're back to square one. Still, worth a try, as it's quite simple to remember.

If you enter "man who" in Terminal, you'll get some different options for the command.

In addition, you can enter "last" to see if there was a login after you logged out.

DESCRIPTION

Last will list the sessions of specified users, ttys, and hosts, in

reverse time order. Each line of output contains the user name, the tty

from which the session was conducted, any hostname, the start and stop

times for the session, and the duration of the session. If the session

is still continuing or was cut short by a crash or shutdown, last will so

indicate.

User - Hide