Continuous hacks

After discovering my five WP blogs were hacked, I followed the advice in

https://codex.wordpress.org/FAQ_My_site_was_hacked

I scanned my computer for viruses, and it came up clean.

I made sure all my installs were up to date, deleted unused plugins, and installed Wordfence to search for malware.

After scanning the site and cleaning up all the malware that Wordfence could find set to its most sensitive setting, I scanned again. When the site showed clean, I reset all the passwords for WordPress, my hosting account, my ftp account, as well as WP.org and WP.com using strong, complex passwords. I also changed the secret keys, generating unique sets of keys for each site.

And yet the next day, I found new malicious files and changes made to legitimate WP files.

I contacted my ISP, and they said the hackers must be getting in through one of my scripts, and the extent of their assistance was to try to sell me an additional security product to lock the site.

This is now a daily occurrence: I eliminate all the malware, only to get up the next morning and find new, different types of malware. Each time the malicious files are buried a little deeper in the file structure, or hidden in places where operating files don’t normally reside. I’m even finding files outside of the directories where the WP installs are housed.

There are no other registered users to the sites or the hosting account other than me, and no login attempts are being recorded by wordfence other than my own.

Any ideas as to the avenues these hackers are using to get in to make these changes?