Another behaviour I found on a website with malware issues.
It keeps downloading random files like one named s2bbGoEJ.html to users computers. It actually tried to automatically download one such file on my own computer. This looks like a 0 byte file.
How do I go about finding this malware and removing it. This has brought our business to knees and we need desperate help.
Edit: I have tried every Linux scanner I could find (ClamAV, rkhunter and couple more) with no luck whatsoever.
Drupal 7.91, Centos 8, PHP 7.2