This is very similar to how MFA bypasses are done now. The user will be tricked into viewing a site that looks like the correct one to input the MFA code but it

This is very similar to how MFA bypasses are done now. The user will be tricked into viewing a site that looks like the correct one to input the MFA code but it will instead be captured and relayed through an attacker controlled connection.