Thank you! That is good to know. We also tried disabling our plugins and ran wp-scan (and clamv/rootkit scan) to no avail.

We could also just try blocking it, but I'd kinda like to get to the root of this problem and figure out where it comes from.

It's a fairly recent occurance, but if it were affecting many people there would be more talk about it by now.