sshLooter is a Python script using a PAM module to steal SSH passwords by logging the password and notifying the admin of the script via Telegram when a user logs in rather than via strace which is not so reliable.
It also comes with an installation script install.sh to install all dependencies on a target host machine.
ssHLooter was inspired to steal SSH passwords via another script using Python to implement a PAM module to log failed attempts, the author just had to change the location where passwords were logged.
The user, password and IP address of the person connecting is sent out via Telegram.
As SSH is used so much in server administration it’s often a target for malicious actors, with a memorable instance being Linux Backdoor Fokirtor Injects Traffic Into SSH Protocol.
You can download sshLooter here:
Or read more here.