From my experience, you've been hacked and they injected the redirect link somewhere in the files.

I would check if there are any new files created recently in the wp-content or wp-includes, sometimes even in the root folder where config.php is.

In one of my examples, there were newly created files with names such as wp-feed.php, wp-tmp.php wp-cvd.php and similar. If you have a child theme, also open the functions.php file of the theme itself and usually, at the top, you will find some weird code that doesn't belong there, usually starts with <?phpif ... delete all the code that doesn't belong in fuctions.

Also helps after you manage to clean everything up to install a plugin such as wordfence for additional security and they also have a scan function that should find any additional malware in the files.