1st time my blog got hacked:
Each page had embedded script code at the bottom that would once in a while try to redirect to a network of weird domain names. Found some modifications to most .php files in Wordpress that did a base64_decode on a long cryptic string. The underlying code was something quite clever, once in a while it would download actual php files to execute from a network of other servers, and would actually execute them sometimes. So I guess the actual payload would be changing whenever someone on those servers updated it.
2nd/3rd time my blog got hacked:
never saw the results myself, but some other folks said that my blog redirects somewhere, or displays some viagra ads. Probably something similar; e.g. wrong content would only be served once in a while? Modification was in wp-settings.php, that was also doing a base64_decode that actually evaluated to require_once (some file named Thumbs.db). That Thumbs.db actually contained a bunch of base64 encoded code that was doing similar things to