Thank you for writing this.

> But if you ignore the warning and go ahead with the login, the attacker does three things: > 1. Steals your password

This shouldn't affect key-based authentication, though

Also, this from Marc-Etienne M.Léveillé email linked in your post:

> Another possibility is a compromised hosting provider. We identified a couple of them in the past where their management servers were compromised by Ebury and their customers' VPSes, containers, etc., ended up running Ebury as well.

Provider-side compromise of customer VPS instances has been a growing trend in recent years. I stopped hosting anything privacy-related on VPS in favor of dedicated hardware. Many people still don't understand how easy it is for a provider to silently dump and/or manipulate both RAM and disk space in real-time.