There is a backend process on my hosting that got hacked few days ago.
The process inserts rows in a table. The website is on Joomla. Whenever I move the website from root to another folder, the sites works fine with domain.com/newFolderName but when I bring it back on the root. It keeps inserting the values.
How can I detect what process is doing that? I can't see hidden files on cpanel. I doubt there could be something in the hidden files too.
I checked the triggers at database end as well, there is nothing like that. Something is fishy on the application level.