Ghost(Pro) is a fully managed hosting environment for Ghost, with no direct access to your site via FTP/SSH. It’s possible to upload any type of third-party code within your theme files, or via code injection in Ghost Admin.
If you suspect that your site's credentials might have been compromised, you should use Reset authentication to rotate all your site's keys and secrets. Every staff user — including you — will be logged out and forced to set a new password.