BuddyPress.org

It’s sensible for the moment to assume the worst. Firstly change your FTP loggin, then look through the actual files for any JavaScript that shouldn’t be there, There are JavaScript Iframe injection attacks that could account for this , however I would expect the iframe to show on all pages injected through index.php files or the html header so would hope there is some other cause in your case.