Same here.
I use “Anti-Malware Security and Brute-Force Firewall” plugin by Eli Scheetz – it can quarantine & delete the file.
However, BE WARNED, on one of the websites I own, the file deletion hung and broke WordPress. It worked fine on four other sites.
Be very sure you have a current and functional backup before proceeding to delete the infected file.
I use Duplicator by Snap Creek to do backups – but in the case of this site I hadn’t made a backup since April of 2017, and I am really paying for that dearly right now.