Anyone affected by this hack and hosts using cPanel, please check your autoresponders in cPanel. While cleaning up the client’s website, we noticed malicious autoresponders were created. The body of the email contained the same malicious JavaScript as infected files. You might not be able to delete them using cPanel UI, so you need to use File Manager and delete them manually inside the .autorespond directory. This is a nasty hack.