Clean malware, harden the site and clear GSC security issues.
Malware sweep + clean install, hardening (2FA, WAF, security headers), GSC security-issue clearance and a post-hack SEO recovery plan.