You can get phised to enter your two factor in a random web forms but it is not possible to do this with U2F (https://en.wikipedia.org/wiki/Universal_2nd_Factor).

For example, Google reported that deploying U2F blocked all phising attempts of their employees : https://krebsonsecurity.com/2018/07/google-security-keys-neu....