A commenter above even provides a source for a novel U2F phishing attack, although it appears to rely exclusively on bugs in the chrome webUSB feature and is likely already patched.

This argument does quickly devolve though; if an advanced persistent threat is taking an active interest in you the only technique that is even close to effective is to cut out as much technology as possible; Bin Laden or Unabomber style