This isn&#x27;t anything new AFAIK. 
I&#x27;ve seen this issue before they do a great job at hiding the code, like pushing it off to the 300th column. WordPress Exploit scanner plugin is your friend here.