I was recently attacked on my Bluehost account after clicking on an email that looked like it was from Bluehost (never going to click on another Bluehost email again). While talking to the support executive to resolve the issue, he said, enabling 2FA will prevent this from happening in the future.
However, I noticed that once I am logged in, I stay logged in for some time (not sure how long). In this case, if I am logged in on the browser I open the email from, I cannot see how the 2FA would protect me.
So will 2FA protect me from email phishing?
According to this tech crunch article
As soon as a logged-in Bluehost user clicks on a link from an email or a tweet to that page, the hidden JavaScript will activate on the page and inject the attacker’s own profile information into the victim’s account — assuming that the user is already logged in to Bluehost — by exploiting a cross-site request forgery (CSRF) flaw.