Seven plus years ago I was investigating phishing scams that were, in real time, taking the username and password, trying it against the real server, and then p

Seven plus years ago I was investigating phishing scams that were, in real time, taking the username and password, trying it against the real server, and then prompting the user accordingly (in that case, kicking them back if they entered the wrong password). It's not that big of a leap to do the same thing to see if they have 2FA enabled.