Defender file scan of core and plugins finds suspicious files quickly. Scanning for suspicious code is very slow and often freezes around 30%. Defender removes two suspicious files and they reappear within minutes. I’ve used another malware remover to confirm dodgy files have been removed.
Each file has one line of characters, like an API key but not sure what it’s for.
I’ve applied all the security tweaks in defender. I’ve removed a lot of unused plugins. I’ve added IP bans and 2FA auth on users. The site is hosted on WPMU and is multisite.
How else can I stop this happening?