@SafariBadminton: check your functions.php file for any culprit code! It sounds like what happened to me - the spam links only displayed on mobile browsers and Chrome.
There could be other files (search other forum threads for reading on the topic), but that is where I've found the issue to be both times I've been hacked. Once cleared out, I always change all of my login credentials.