I'm having this big problem. I have 3 Ubuntu VPS boxes with [a WordPress service provider] and a dozen websites on each, and the problem affects all of them. All are Wordpress.
What happens is, I keep cleaning the sites and they get re-injected with malicious files. I wonder how they regain access.
I have some newly built sites on clean installations that also got infected, so I suspect the infections bleed from one site to the next. [This WordPress service provider] puts all the website folders under the same www-data user, so scripts that want to go between folders aren't blocked by permissions.
All I could do to slow this down was to make root the owner of the sites as I clean them. I put all WP files, plus the themes and plugins folders under root. Everything else in WP-Content stays under www-data. This seems to stop the reinfection of these sites, but then they need to have permissions changed every time I update something.
I do not see new Wordpress users. I haven't changed user passwords or database passwords lately, I admit.
Could database injections be the cause for reinfection?
Today I was hardly finishing up cleaning a site when some files were already reinfected. This is consuming increasingly more of my time, and I don't see a solution.

[edited by: phranque at 9:08 pm (utc) on Dec 22, 2020]
[edit reason] hosting specifics [/edit]