This is the first time this has happened to me. I'm attaching the screenshot of the message I got about the threat. Also here is the link that ESET software shows me for more info about this.
I ran malware scans on the website, but maybe these can't check the .sql file being assembled + exported, only the other files of the site (?).
A threat (HTML/ScrInject.B) was found when Google Chrome tried to access a website ..XY"
Thanks to the conversation below with @closetnoc, I found a pretty suspicious line in the database by searching for
/script> etc., and inspecting the few results I got. Here is what I found so far (on line 477799):
The 'balantfromsun.com' domain shows malicious to my browser. I think we caught some malware from there already. Now I'm trying to find the file which injects this code to the DB.
Apparently Wordfence plugin itself placed the problematic script into the DB (my question: WHY? ), into the wp_wfhits table. I deleted this specific row (shown above) and the antivirus no longer gets triggered.