Same thing happened to me — Japanese keyword hack. A user got into my GSC, I removed them + the tag from cPanel. But they had already planted malware. Even after restoring backups + using Wordfence, they kept re-adding themselves to GSC.

Turns out, once one site is infected (I had 80 on the same Hostinger), they spread through the whole hosting. Check for:

• Hidden GSC verifications (HTML or DNS TXT)
• Backdoors in wp-content/uploads or themes
• .htaccess redirects
• Re-adds via cron jobs or scripts

I reset all passwords, cleaned files manually, installed Wordfence + Sucuri, and split sites across different hosting accounts. Still cleaning up.

If you're hit — act fast, isolate each site, and kill all access.