Well, a MF managed to install a full fake paypal (Phising) site on my website, I received a closure notice from my hosting and I had to delete that entire site in order to restore my website...

I have lots of PHP scripts, the main suspects of this issue...