[fnl]

> They capture the 2FA code

How can that be done? That's between my phone and Google, so how can they "listen in" on that?

[putlake]

The phishing site will ask you for your 2FA code and then enter it on the real Google login page.

[fnl]

Hmm, but that gets us back to "stage one": For that to work, you have to ignore your URL-bar...