Things like this: https://security.stackexchange.com/questions/157756/mitm-att...
This is assuming an owned machine. Not the easiest attack but still possible. Obviously things like Google Authenticator (while good) are even more susceptible to MITM phishing.
Re:AWS now supports U2F/Yubikeys
by scrollaway on Wednesday September 26, 2018 @04:43PM
(#18080089)
If the machine is owned it's trivial to dig the cookie jar once you're logged in.
U2F credentials are tied to a particular domain, and so do not rely on the user making sure they are on the correct website. As such, they are not susceptible to typical credential phishing attacks.