I would diagnose/fix as if there was a hack of your system. Lots of references in the googles about that.
But my technique is to change credentials on everything (hosting, wp admin users, database, FTP users), reinstall/upgrade everything (WP via the Upgrades page, plugins and themes via manual FTP transfer), check Child Theme code (if any), and then look for rouge files in all site folders manually. Including hidden files (check htaccess files everywhere).