WordPress Malware Removal / WP Security

Our wordpress site has malware. A fake CAPTCHA appears on all browsers when user is on MacOS. The fake CAPTCHA asks users to open terminal and run a commmand. We don't know how long this has been active on our site. Our site stack is: cloudflare, cpanel, wordpress, elementor, Accelerator by seraphinite.