Ran a quick check, realizing there was remote access to the machine with a script copying files. Disconnected the internet instantly and did a thorough inspection. Found an osascript from the terminal moving files to Library/Caches, possibly for uploading.
Desktop documents sync to iCloud and contain sensitive information. It's essential to stay vigilant because it's more of a 'when' than 'if' you'll be targeted.
Stay vigilant!