Thanks @macmanx for these links. I already have security and backup happening, although the security product didn’t include a firewall. So I’ve installed WordFence now. All WP user passwords were changed using LastPass generator. Numerous scans were done (via Securi plus my hosting security product) but can’t find that rogue file. However, had a full file & database clean done anyway through my hosting company. Scanned my laptop and iMac using Malwarebytes — both clean. Created a full document outlining all steps. Have always used Google Apps for my email. Checked Google Search Console, not blacklisted. Looks like that URL only started appearing May 31, so it’s recent and I will continue to watch for it showing up, or hopefully not showing up. I’ll repost here if after a few days of careful watching.
