Hi
today i found this malware, after scan
Filename: wp-content/plugins/ccode.php
File Type: Not a core, theme, or plugin file from wordpress.org.
Bad URL: http://www.deleted.xyz/update.php
Details: This file contains a URL that is currently listed on Wordfence’s domain blacklist. The URL is: http://www.deleted.xyz/update.php
and the code in the file is
[ Deleted, do not post malware code on this site again ]