Redirect malware

I have a redirect malware somewhere on my site. Symptoms:

1. Only mobile and iOS users
2. Random
3. Seems to always happen for new users, but following requests works fine

I have upgraded WordPress and all plugins, changed the theme, removed unused plugins. Also inspected common php and .htaccess file.

Anyone has any clues?

Any recommendations for experts that could help me out?