How to find a malicious string?

Question

Malware

Found this line/url-scheme in the browser debugger:

Screen

Screen

As I understand it, someone encrypted and hid a bunch of obscure links in the site files:

Screen

I can't figure out where this line is connected.
I tried all sorts of plugins like String Locator, Exploit Scanner, searched with my hands in files - all to no avail.

Please tell me how and where to look, where to look?

Answer 1

Actually, it's like an ad blocker in your browser.
It even has the address data:text/css,... , i.e. it was created locally in the browser, not coming from the server.

Answer 2

Most likely in the functions.php of the theme. And most likely it will not be a regular list with an url, but some kind of curl script that pulls out this list from somewhere.