The virus was found on Bitrix, or rather the hosting was found. Who knows what it means, why it was introduced, and most importantly, who benefits from it?

Question

Malware

MB developers want to have something like that?

Answer 1

Admin login. if the link contains P=1234567890

Answer 2

Quite a common backdoor. Not a virus, and not anything external that infected the site.
The bookmark was left by those who had full access to the site. Judging by the name of the folder - in some old modifications.