WordPress themes & plugins from trusted or unknown source
Do you use WordPress themes and plugins from sources other than WordPress.org or premium theme sources? Some people use WordPress themes and plugins where there is lots of chances of infection. I have seen some themes have encrypted links which when removed your website gets broken. But if you still keep them, they use shady script inside theme or plugin folder and try to hijack your website to earn some bulks from cheap ads.
I always use theme and plugin from WordPress.org or trusted premium theme or plugin websites.