This isn't anything new AFAIK. I've seen this issue before they do a great job at hiding the code, like pushing it off to the 300th column. WordPress Exploit scanner plugin is your friend here.