Yeah it doesn't matter when you literally give them your name, password, and token via a fake login page.
The type of 2fa isn't ever taken into account. It could be 6fa for all they care, if someone was tricked into logging in thinking it's legitimate, they're ponying up all the details.