probably hacked website, you need to check the logs are clean account from the malware
This could be a serious issue and should be done properly by the experienced sysadmin or cwp support from the start or the malware will expand and it will be in the backups and you will not be able to recover that site anymore ...or the only way will be to remove all files and install all new.
Also if you don't have cwp secure kernel that kind of malware could expand on other accounts.