Update: Accessing my site in Safe Mode allowed me to see WPCode
https://example.com/wp-admin/?wpcode-safe-mode=1
There again there was an malicious “Untitled” Snippet.
So how can I prevent these? As soon as I remove the snippet the site is fine but crops up.