A heads-up about Multi-Factor-Authentication

You can still be phished.

The malicious link leads to the attacker’s proxy server that, thanks to the phishing-as-a-service toolkit, looks identical to the real Google login site (except for the URL displayed in the address window). The user then enters their username and password.

The proxy then forwards the credentials to the real Google site. Google will then send the proxy server an MFA request, and the proxy server sends it back to the victim, who is expecting it since they believe they’re trying to log into the legitimate Google page. The victim then sends the MFA code to the proxy server, which sends it to the real Google site.