Help SSH/SFTP to WordPress

Hello all –

I’m new to WordPress, engaged because a friend of mine had his WordPress site hacked. He’s asked me to fix it for him but to do so, I have to be able to SSH or SFTP to his site so I can remove malicious files. Unfortunately, I haven’t been able to figure out how to do this. I’ve looked into WP-CLI but if you don’t set that up in advance, you can’t really do anything.

So, any ideas? So far, I’ve been able to access the site through wp-admin. My SSH attempts connect but username and password fail, leading me to believe that these credentials are separate from the wp-admin credentials. Not sure where I generate a key pair or get these credentials. He is subscribing to a premium WordPress.com account, not hosting it on his own or through another hosting provider.

All other forums and online help offer nothing useful. Really banging my head against the wall here so some help would be greatly appreciated. Thank you!