My wallet was also passwort protected which is why I am asking myself if malware just waits till the wallet has been opened.
That’s most likely what happened.
If your device is infected with a malware then the hacker may have full control over it and will have access to all your files including the wallet file.
However, if you have used a strong password to encrypt your wallet then the hacker can’t do anything with the encrypted file and he will have to wait for you till you open the wallet and type the password.
As you already know, there isn’t much you can do to get back that money without knowing the identity of the hacker but what you need to do is to stop using that wallet and create a new one on a clean device.