I have a website that was hacked three months ago, I cleaned up the code at server end redirected the unwanted pages.
Created new sitemap but somehow these pages are not deleted even after applying Removal URL request in Google Search Console.
Now no Security or Malware issues are there in Google Search Console.
Actual website url are also being shown with these urls when I search on Google as :
site:example.com