Not the exact scenario you described, but there has been an instance on the Snap store where someone uploaded a crypto wallet management program and it was actually stealing keys.

https://www.reddit.com/r/Ubuntu/comments/1olfrff/there_is_a_...