Is there any way out of this?

Hi folks,

I have a network of 10 WordPress websites that I recently moved to a new host.

Unfortunately, shortly after moving, the sites became obviously infected (defaced with spam).

At a couple of experts’ advice, I set up a new hosting account, and did a minimal All in One Migration export as follows:

View post on imgur.com

Unfortunately the code is reinjecting, which makes me think that the databases are compromised. However, I can’t see any obvious malware and the sites pass a Wordfence check.

Is there anything else I can try at this point or should I delete all the websites at the new hosting and just do everything manually (are even the images safe if I download them from a browser and re-upload or could even they be compromised?)