nav-menu.php injected everyday

Wordfence is detecting nav-menu.php with the following code being injected every day. https://pastebin.com/nqdm060F and it changes .htaccess contents and timestamp which wipes out all my .htaccess contents.

Replaced both files and within 24 hours sometimes less, here it is again.

Can anybody work out what is actually does and where it might be comming from?

All scans says site is clean. and server logs are not helping me.

https://www.ads-software.com/plugins/wordfence/