Hacked site. Fixed. Nailing down the cause [duplicate]

Question

One of the sites I manage was hacked, basically the hack consisted in redirecting users to other external webpage (sort of advertising spam malware).

I have moved the hacked site to a staging site and restored a clean copy of the site. Then I have uploaded Wordpress core to original state, updated to latest plugins.

So now I am focusing on the hacked staging copy, attempting to understand what and how it happened.

I use Wordfence as a defence tool, hence the plugin was already installed when the hack occurred. Nevertheless I have performed a full scan on the staging copy and got an alert about a user (one of the legit administrators): "wordfence user account created outside of the domain". Maybe the user password was sniffed/stolen somehow, as no brute force attack were reported by Wordfence. I have deleted the user for safety reasons and continued investigation.

Then I have installed and run Sucuri, Exploit scanner and Antimalware plugins: No evidence of malware, apart from lists of possible false-postives in multiple .js files.

Followed instructions in these articles, helpful to restore and clean code

• FAQ My site was hacked « WordPress Codex
• Malware Removal Checklist for Wordpress - DIY Security Guide
• WordPress Hacked Redirect, How to Detect and Clean it

but none of those helped to find where hack is.(verified, headers, footers, wpconfig, htaccess, etc, etc)

Then I have switched to default WP theme and the hack stopped, so I have realised that (apparently) the hack was performed in my theme and child-theme code, therefore I have downloaded both folders copies (good one and hacked) and performed diff on sources (clean vs hacked). Basically minor differences where found in PHP code, but nothing suspicious.

Things to mention: about 30 copies of existing posts appeared in the posts list as drafts, with basically little text in the body (no malicious code in there). Looks like someone created those copies randomly.

The hosting provider performed site and account checks and no malware was found. BTW there was no trace of geo-located logins through my cPanel account nor with FTP accounts other than the town i live.

I have also attempted to debug the hacked staging site in Google Chrome attempting to halt execution when the redirect occurs, hoping to find a reference to the offending code, however this didn't work too. Maybe the redirect is not performed with Javascript.... but there are no META refresh tags in the source code of the generated page.

I am aware that latest techniques involve hiding code in images, making the task more difficult.

Conclusion: the site was hacked probably by someone that has stolen secondary administrator password, although I wonder if the hack may be performed by a editor-equivalent user.

What I currently miss: an in depth analysis of the database and sources code.

I wonder what else I could check to understand where did the hack got place and how!

Addenda 1

Any page on the hacked site will load but quickly redirected. to further test this I have opened two Chrome tabs with "view-source:" one from the hacked site and one from the clean site. These are identical.

As I wrote, I have followed the guides linked in this post, so I will explicitly add some other info on what I have done (but this relates to the cleaned site, so it's a bit out of scope here):

1. Changed WordPress admin user passwords
2. Changed Hosting account user password
3. Change FTP passwords Change MySQL db user password
4. Updated wp-config nonces/salt
5. Blocked directory-browsing access, via .htaccess

This post differs from Verifying that I have fully removed a WordPress hack? as it focuses on where is the hack and not on what to do to esnure the hack was removed!