The wallet was newly created and installed on a new and secure VM With Defender, E/M/XDR, all updates, firewall etc) and has been online for only a few hours in total. No suspicious services running. I downloaded Electrum on original site and checked that it is legit and has cert etc. That front it good.
Given you stated you checked digital signatures etc, then it would appear your seed/wallet has been compromised in some other way.

Since he mentioned "
Defender", he may be using Windows and OP may be talking about the "
DigiCert" SSL Certificate that came with the Windows binaries that can be seen in its file properties under "
Digital Signatures" tab.
@OP if you haven't done this initially:
bitcoinelectrum.com/how-to-verify-your-electrum-download, try it to your downloaded Electrum binary to see if it's actually Electrum.