Magento Malware Cleanup & Backdoor Removal (active, recurring infection)

We run a Magento 2.4.6 store (Claue theme, hosted on Cloudways) that has an active, recurring malware infection. Third-party security scanning (Sansec) has detected malware on our checkout pages intermittently since November 2024, across several different campaigns. The most recent is a script loaded from an external domain, injected into a CMS block's stored content, that specifically checks if the page URL includes "checkout" before loading additional code. We found and removed the malicious script directly in the database, but it reappeared within a day, confirming an active persistence mechanism (backdoor) somewhere in the codebase, not just a one-time content edit. Note: our checkout has always redirected to PayPal for payment, we've never collected card details directly on our own site, so no card numbers were captured on our pages. Still need this fully cleaned up and the backdoor found and closed. What we need: - Full forensic sweep of the Magento filesystem for backdoors, web shells, or modified core/template files - Review of scheduled cron jobs for anything unauthorized - Review of admin user accounts and roles for unauthorized access - Root-cause identification: how the attacker is getting back in - Full removal of all malicious code and backdoors, not just the visible script - Apply the pending Magento security patch APSB26-49 - Verification that the site is clean after cleanup, ideally with a follow-up check after a few days to confirm no reinfection What we can provide: - Sansec's detection history report showing the timeline and specific malware signatures found - Temporary, scoped SSH and Magento admin access for the duration of the job (removed after completion) - Access to Cloudways backups if needed for comparison Looking for someone with specific experience in Magento malware remediation and skimmer removal, not general store maintenance. Please share relevant past experience with similar cleanups in your proposal.