The newest authenticators make a fingerprint of your browser and use that to select a random number that they show you in the app, along with other "controls".

The newest authenticators make a fingerprint of your browser and use that to select a random number that they show you in the app, along with other "controls". You have to pick the correct number, which of course the attacker will not have.