[Manal]

This happened to me a few days back to Shadow Hosting's blog. I was alerted soon when an "unknown" popup appeared asking if I need confirmation for notification. I never installed any plugin where notification was asked so I ran around and checked. I scanned the website using Sucuri's Web Scanner(free) and found out that my website was hacked(or code was injected as you described). This resulted in my domain name listed in Spamhaus. I immediately changed all passwords, scanned everything and found my website was clean. I ran a check again but found nothing this time. I was a little skeptic now because I thought there is something that triggers the malware that if I login into the admin panel, the malware will be disabled for some time. I managed to get the domain out of spam listing.

Fast forward few days, this happened again and before it was listed as spam, I immediately downloaded WordFence and scanned. I found some unknown defines in "function.php" of all themes and other things named "wp_vcd" or something which was causing. Since it was an unknown file, I Googled about it and found it is an unknown file and doesn't come with WordPress default config either any plugin. I ran a scan through WordFence, removed all such files, disinfected what was necessary and now my website is all good.

So the solution for such problems is, you should keep checking your website for any malware on the homepage with Sucuri's free scan.