Oh, so I plugged into the wrong backend xD
My attempt in itself (if it had been in the right place) should have been correct as login/index.php is raising the event:
182 //* Incorrect login - Username and password incorrect
183 $error = $app->lng('error_user_password_incorrect');
184 if($app->db->errorMessage != '') $error .= '<br />'.$app->db->errorMessage != '';
Seems I just need another place to call my registerEvent.
I tried it in ~ispconfig/interface/lib/plugins - but that also seems to be a wrong choice.
Do you have any pointers for me?