The user sees what looks like the normal Microsoft or Google sign-in. They type their password and approve MFA as usual. Behind the scenes, the fake page passes everything to the real one and keeps a copy of the session token.
The attacker then replays that session from their own machine. They never need the password or the MFA prompt again, which is why MFA alone does not stop it.
How Centeye handles it
Centeye Gatewatch spots a session that doesn't match the person's laptop and ends every session at once.
Gatewatch: identity protection (ITDR) →Go deeper: How AiTM phishing works