Plugin infects site with remote malware

Plugin includes remote JS which adds a user account onto your site when an admin is logged in and views the site homepage.

Username we keep seeing is something like wordpress_updates or wp_updates and an email address of wordpressupdate@yandex.com