The video below describes a form of an attack that, if you don’t spot it, will defeat MFA protection.
A variation of this attack is very easy to implement if the attacker has control of the network that the computer is connected to, and there wouldn’t be a fake URL to spot.