Please folllow @Ziaul tips. We have separate topic for security.
Yes, hacker could compromise your site many days ago and hidden malware code that was waiting for activation. This is a very popular method.
Even if you updated SPPB today or yesterday, it will not clean your site, It doesn't work this way with any extension.
You have scan whole server and clean all malware files. Hosting support should help, they have firewalls/antivirus tools. Then follow tips from shared forum topic, also mine.
II Cold War, this time in Cyber Area.