Code injections + unknow files in file manager

Hi hope you doing very well i am facing a issue since a months ago daily i found bad codes injection in indexes files + new files uploaded .. there is some thing like bot -- the issue is only in one user account and the credentials of Cpanel only with me. how i can track and disable this type of exploit. Regards