::
This would not surprise me in the least.
There were definitely malicious versions of LL for, I think, Android and Windows circulating last year. At least one was on a trusted (not Ledger) app library site.
Given how many folks seem to fall for the „enter your recovery phrase here“ scam, this seems like a good way to snag even those who try to get the official version.