I'm trying to understand what are the risks derived from unprotected communications within the same device, by the use of the loopback interface. I've verified it is possible to capture packets, with administrative privileges, on both Linux and Windows systems, by using Wireshark or RawCap/SocketSniffer tools. Would it be possible for some kind of malware to capture packets exchanges on the loopback interface in the same fashion, provided the malware obtains the needed privileges ?
If you can do it (with Wireshark or another tool), then any program that has the same privilege level as you can theoretically do it as well.
So if the question is: can the loopback interface be sniffed? I'd reply YES. From what I know, it's more or less the reason why it was created in the first place.
Mostly not. On Linux, there are security patches against this (I can't remember their name, but maybe you can get help here).
But: the sniffing on the loopback device needs root permission (or some tricky capability), what the attacker has, he can do anyways everything.
There is also a special case, which may be relevant for you. The virtualization softwares use normally their own solution for the inter-vm communication, which is practically a loopback as well, but it has mostly some types of protcetion against such attacks.