The attacker’s proxy relays a 6-digit TOTP code to the real Identity Provider in real time. After the engineer taps "Approve" on a push notification, the session goes to the proxy. FIDO2/WebAuthn defeats this completely because the hardware key has no credential for login.chronos-orbital.net and signs nothing.