attacker has gained access and is able to run a shell as my regular non-root admin user
If this is the same account as you use to do privileged operations with
sudo then the attacker could make changes to your environment which make you run a different binary. In the simplest case this would be changing PATH so that just typing
sudo would actually not run
/usr/bin/sudo but some rigged
/home/admin/.attacker/sudo. This attacker provided sudo implementation could then sniff your password and then just start the real sudo.
But one can make it more stealth, like changing your profile so that it spawns an attacker provided shell with included key logging. Or just run script to log every input and output.
If so, are there any precautions I can take to minimise this keylogging risk?
Don't allow local users on the system. General hardening of the system. Limit the users with special privileges (like ability to
sudo) to only some well-protected accounts.