SEO traffic and reputation can recover within 24 hours if you act quickly and correctly. Make absolutely sure that your site no longer hosts malware, spam or any content the attacker may have installed. If it still contains anything malicious you will waste time having to redo this process. Add your site to Google Search Console immediately in order to understand what URLs on your site are infected and what the status of your site is. To get your site back into the Google search index, you need to “request a malware or unwanted software review“.
Malware reviews by Google tend to be faster than reviews related to SEO ranking. If your site no longer contains malware, your site may regain its ranking within 24 hours.