Help me remove malware from my hacked WordPress website using the latest version of the Avada theme. I am currently using Avada 7.16.1.
I have already tried Wordfence, Hide My WP, CleanTalk Security, etc., but the problem still exists. An unknown administrator keeps logging into my website regularly, even though I did not create this administrator account.
I regularly receive email notifications saying that an administrator account has logged into my website.
Kindly help me identify how the hacker is gaining administrator access and completely remove the malware or backdoor from my website. I also want to make sure that the attacker cannot regain access after the cleanup.

Update: issue solved, malware removed !!! thanks Torcod
I have already tried Wordfence, Hide My WP, CleanTalk Security, etc., but the problem still exists. An unknown administrator keeps logging into my website regularly, even though I did not create this administrator account.
I regularly receive email notifications saying that an administrator account has logged into my website.
Kindly help me identify how the hacker is gaining administrator access and completely remove the malware or backdoor from my website. I also want to make sure that the attacker cannot regain access after the cleanup.

Update: issue solved, malware removed !!! thanks Torcod