Live case: comastrial.com/shop, a B2B PrestaShop 1.6.1.24 store. Staff and customers could not log in. Header and footer looked normal. There were no email or password fields. #center_column was empty.
The authentication template still existed. The front controller never assigned it on a normal login URL.
Cause
controllers/front/AuthController.php was infected. Early in initContent() the malware required a secret query parameter and otherwise returned before setTemplate('authentication.tpl'). The infected file was ~64 KB against ~36 KB for a clean copy of the same version. That size jump is a signal.
Fix
Restore a clean AuthController.php from a known-good copy of 1.6.1.24. Correct two theme issues found in the same incident. Clear Smarty cache. Verify EN and ES login forms in the HTML. Do not reinstall the whole shop blindly.
Why this pushes an upgrade
PrestaShop 1.6 no longer receives current-branch security patches. A surgical restore brings login back. It does not make 1.6 a long-term plan. The honest next step is a staged migration to 8.x or 9.x with backups, module inventory and checkout tests.