countless-factory

I have recently been noticing a lot of websites being infected with a plugin that is installed in the plugins folder named: countless-factory. This plugin does NOT show in the list of plugins. Checking the Wordfence Firewall, I am seeing legitimate Admin users logging in but from locations that are not regular locations. This seems to have started on 30 September. Cleaning it with Wordfence breaks the site as some files are left behind in the folder. I must have cleaned over 100 sites in the last week or so. Enforcing 2FA for administrators seems to stop the incursions.