That was the low-tech part of their attack, and was my fault - both for clicking on it and for my phrasing.

It wasn't a single-click attack, sorry for the confusion. I logged into their fake site with a TOTP code.

This is a clear example that this can happen to anyone.

Sorry for what you're going through.