One of the most common manual actions a site will receive in the Google Search Console is around malware or hacked website content. It is a growing issue and more and more sites are hit by this every single day. If a site is flagged as being compromised, Google often will remove or flag the site in the search results.
But once you clean up your site and remove the malware, your rankings should not be impacted in the long run.
Glenn Gabe asked John Mueller of Google about this on Twitter and John said "malware can be tricky (cloaked redirects, etc), but once cleaned up, it wouldn't have a longer-term effect on search visibility."
Here are the tweets:
Malware can be tricky (cloaked redirects, etc), but once cleaned up, it wouldn't have a longer-term effect on search visibility.
— John ☆.o(≧▽≦)o.☆ (@JohnMu) September 13, 2017
Obviously, having malware on your site isn't a good thing. Not a good thing for your Google rankings but not a good thing for your business and your web site users.
Forum discussion at Twitter.