Cloaking attacks are a nightmare! Since it looks clean to you, hackers are likely targeting user agents. Check your web.config or index files for any hidden scripts or redirects. I’d also use Google Search Console to see exactly what bots are seeing. A full server security scan is a must. Good luck!