Is it not possible to capture both the login credentials and TOTP code from a phishing form and submit them to the real service in real time? It would seem pus

Is it not possible to capture both the login credentials and TOTP code from a phishing form and submit them to the real service in real time? It would seem push notification style 2FA ala icloud/gmail/Duo/blizzard is the better solution but that also opens up a vector for users who simply accept every push notification request. U2F would seem better than both those options but alas that can still be lost or stolen and compromised before access can be revoked.