Been dealing with this on a friend’s site (helping him manage it) and following this thread to see what others are doing about it. Seems to be pretty new I guess since there’s not much info about it to be found.
I do have one idea about its origin. I think it miiighhtt be related to (don’t get out the pitchforks) Jetpack.
And I do agree with the prognosis that there’s an undetermined backdoor, because no matter what action I take, I can’t seem to completely stop the repeat infections on the site. (possible server issue? ie something I can’t control directly?)
So far I’ve just been using Wordfence to keep the site clean and operational by auto-scanning daily, and repairing and deleting frequently. That’s worked fine so far, but it’s still a pain (and potential danger) and I would love a permanent fix haha.
