@huronbikes @GossiTheDog Make sure the device concerned is completely disconnected from any network; forget all known WiFi connections.
Then rotate all API keys, tokens, logged in account sessions, etc, on a clean machine.
You can come back to the compromised machine later, the main thing is to ensure what you have is locked down; that's more important.