Find evil hidden iframe’s
find / -type f -name '*.htm' -exec egrep -H '<iframe src="(.*?)visibility: hidden' {} \;
And change .htm with every extension you suspect (php, html, js)
find / -type f -name '*.htm' -exec egrep -H '<iframe src="(.*?)visibility: hidden' {} \;
And change .htm with every extension you suspect (php, html, js)