How it works
Most phishing pages just store what you type. This kind does more. It runs as a proxy: when you enter your email, password, and 2FA code on the fake page, the page feeds each one into the real Google login as you go and passes Google's responses back to you. From your side the login "works." Behind the scenes the attacker is now signed in, and the page quietly copies the session cookie Google hands out after a successful login. With that cookie the attacker can return to your account later without needing your password or a fresh code at all.
This is why "just turn on 2FA" is not the whole answer here. Codes from text messages, authenticator apps, and tap-to-approve prompts can all be relayed by a proxy in the seconds you spend on the page. What this attack cannot relay is a passkey or a hardware security key, because those are cryptographically tied to the real website's address and refuse to sign in on a lookalike domain.
The tell-tale signals
- You reached the login through an email link rather than by typing the address yourself.
- The address bar is not exactly accounts.google.com, even when the page looks perfect.
- The link that brought you there used a shortener, a punycode lookalike, or a raw IP address.
- The sending domain is new and lacks mail authentication.
- The page relays your SMS, app, or push code in real time, so entering a valid code does not keep the attacker out.
What to do
The defense that holds up against this is phishing-resistant login. Add a passkey or a physical security key to your Google account, and if you are eligible, enroll in the Advanced Protection Program, which blocks most of these flows outright. Always start a login by typing accounts.google.com or opening the app yourself, never from an email link. If you think you entered credentials into a proxy page, act as though the session was taken: from a trusted device, change your password, then use your Google security page to sign out of all other sessions, which invalidates the stolen cookie, and review recent security activity and third-party access. Checking the original email in LegitSponsor first usually surfaces the link and sender evidence before you ever reach the page.