If there's a MitM attack, you've already lost. Sure, they can only login one time, but they're in once you provide the authentication steps. Phishing sites c

If there's a MitM attack, you've already lost. Sure, they can only login one time, but they're in once you provide the authentication steps. Phishing sites collecting and using the 2FA creds in real time was discussed here, among other places: https://security.stackexchange.com/questions/161403/attacker-circumventing-2fa-how-to-defend/161545 https://security.stackexchange.com/questions/161403/attacker... With available open source like https://github.com/ustayready/CredSniper https://github.com/ustayready/CredSniper readily available, you're only going to stop lazy phishing attempts. You only get protection if you assume the scripts are just passively collecting information for use at a later time. If they're actively logging in to establish sessions while they're phishing, it's game over.