Hey everyone, hoping someone here has seen this before.

I'm dealing with a persistent infection on a client's WordPress site. A few weeks ago I found obfuscated PHP code injected at the bottom of the child theme's functions.php file, wrapped in comment markers like this:

SC_TH_BEGIN followed by a version number and a hash, then the code block, then SC_TH_END with matching version and hash.

The code itself used deliberately meaningless function and variable names, decoded a large encoded payload at runtime, and wrote a hidden file into the mu-plugins folder. I also found a handful of small unfamiliar archive files sitting in the uploads directory that I hadn't put there. The injected code included logic to check a hash and quietly rewrite itself if anything was missing or changed — basically self-healing behavior.

Here's what I've already tried:

Removed the injected block from functions php by hand
Found and deleted the suspicious mu-plugin file
Changed every password — hosting, WordPress admin, database
Tested with a completely fresh WordPress install locally using a backup, confirmed that copy was clean
Re-uploaded and reapplied cleanup carefully

About two weeks later, the same block reappeared in functions.php — same hash, but a higher version number, and this time the actual malicious code was replaced with an innocent-looking comment saying something like "this file previously had malicious content but it's been removed and is safe now." It really does seem timed to specifically counter cleanup attempts, like it's tracking that we're actively trying to remove it.

Has anyone run into this pattern before? Particularly interested in:

Where this kind of thing usually re-enters from if the obvious dropper file is already removed
Whether this sounds like a known campaign or family of malware
Any tools people trust for finding every infected touchpoint on a WordPress site, not just the obvious one

Really appreciate in Advance