I was working from Starbucks today on my Macbook Air running OS X 10.11.5, and a strange thing happened.
I was in Chrome and browsing the web, when a Bluetooth connection request popped up from an unknown device. I rejected the connection, and continued on, assuming someone had simply accidentally requested to pair with the wrong device. A few minutes later, another pairing request from the same device, I rejected it again, and then turned off Bluetooth. (I noticed that there were two trusted devices listed - an apple keyboard and trackpad.)
I was working in Chrome and had several windows open, and within a few minutes, it had completely bogged down and was beginning to lock up (somewhat unusual, but not entirely unprecedented since it'll occasionally max out on RAM with lots of chrome tabs open, but usually it's a far larger number).
I decided to reboot, so I closed out everything and hit restart. During reboot, it briefly showed some error messages and text over an image background. Unfortunately, I wasn't able to read much of the text before it moved on, but it mentioned the registry and listed out lots of memory locations like
0x01515125125 etc. I've never had any issues with it or seen the screen before. It did a quick cycle through and then presented me with the normal login screen.
It seemed very fishy to me at this point, so I loaded into the guest account. I was googling around to see if it's even possible to get hacked via an open Bluetooth connection, and then a box popped up saying 'Safari wants to use your "login" keychain', which I canceled (never seen before, but then again - I don't use safari), and continued browsing. A few minutes later it popped up again and I was like "f it I'm out" and left. Booted my laptop on the way home and logged into my admin account and disabled Wi-Fi.
Am I being super paranoid here? Is this even possible to get a keylogger or malware like that? How could I verify?