Newer Yubikeys support U2F, which I haven't seen any way to phish yet, but the Yubikey protocol is still possible to phish. To do this, the fake login page say

Newer Yubikeys support U2F, which I haven't seen any way to phish yet, but the Yubikey protocol is still possible to phish. To do this, the fake login page says that the token was incorrect the first time (which would possibly alert some people, but certainly not everyone), and then when the user submits a second token, the phishing site sends the first one to the real site. They now have an unused token which can be used up until the user logs into another website (thus invalidating the 'unused' one).