Codes, push prompts and texts can be passed along by a fake login page, because the person types or approves them themselves. Phishing-resistant MFA checks the real website address as part of signing in, so it refuses to work on a lookalike.
CISA calls FIDO/WebAuthn the only widely available phishing-resistant authentication. It is the strongest defence against AiTM phishing, and the place to start is admins and anyone who handles money.
How Centeye handles it
Centeye Gatewatch spots MFA prompt floods and stolen sessions for the accounts that are not on phishing-resistant MFA yet.
Gatewatch: identity protection (ITDR) →Go deeper: AiTM phishing explained