Today I find out my website is infected with Trojan:JS/BlacoleRef.BV. The server is a shared server from a hosting company.
How does a trojan like this get on the webserver?
There are a whole bunch of ways:
All are equally possible.
As it was mentioned above, a lot of bots are trying to find vulnerabilities in your code or in your server services, which will be used to place malware code on your server.
However, this is not the only way. Very common practice is - malware on your computer. There are tons of FTP clients malwares which steal your credentials. In some cases, FTP passwords are stored as plain-text in configuration files - very easy stuff for malware.
So check your logs, check every files on your server, but also don't forget to run AV scan on your PC.