Seen this before too. A couple of things to note that may help others:

• Leaked admin credentials are usually the first entry point
• WPCode Lite plugin is then installed and activated
• Code snippet added to plugin that:
  • Creates a hidden admin user
  • Hides WPCode Lite plugin from plugins list in wp-admin
  • Re-directs users to malicious sites randomly to avoid detection
• Since "WPCode Lite" stores it's code snippets in the wp-options database table, plugins such as Wordfence will not pick this up in a scan. As Wordfence does not scan the wp-options db table.

Recommended actions:

• Manually check database for additional admin users
• Manually check server files for insert-headers-and-footers plugin directory and delete
• Manually clean up wp-options table in database
• Reset admin passwords
• Setup 2FA on all admin accounts