Sitecheck

There is a type of spam that hides from regular HTTP requests by checking if the User-Agent and/or IP address matches certain criteria.

For example, the malware could be checking if the User-Agent is the same as the one that Google uses in their web crawler, this way, if Google is scanning your website the malware will render the malicious text, but if it’s not then it renders the normal website.

Check all the “.htaccess” files that you can find your web server (all of them, not just the one in the root). There could be malicious conditions there that could be triggering or hiding the malicious code from you. If you cannot find any suspicious conditions in the access control files, then keep scanning the source code for similar conditions, and then the database.

Here’s an article [1] that explains how to clean your website from malware.

Let me know if you need more information.

[1] https://sucuri.net/guides/how-to-clean-hacked-wordpress