Would two factor authentication on my web hosting account protect against email phishing targeting my site?

Question

I was recently attacked on my Bluehost account after clicking on an email that looked like it was from Bluehost (never going to click on another Bluehost email again). While talking to the support executive to resolve the issue, he said, enabling 2FA will prevent this from happening in the future.

However, I noticed that once I am logged in, I stay logged in for some time (not sure how long). In this case, if I am logged in on the browser I open the email from, I cannot see how the 2FA would protect me.

So will 2FA protect me from email phishing?

According to this tech crunch article

As soon as a logged-in Bluehost user clicks on a link from an email or a tweet to that page, the hidden JavaScript will activate on the page and inject the attacker’s own profile information into the victim’s account — assuming that the user is already logged in to Bluehost — by exploiting a cross-site request forgery (CSRF) flaw.

Answer 1

The short answer: It depends. 2FA stops people from breaking in, but it can't do anything if the account is already broken.

The long answer:

This specific attack will likely succeed if it is pulled off successfully, regardless of whether or not you have two factor authentication, as 2FA is a protective measure to help secure your account from being broken into. 2FA is very difficult to be protective if the hacker is already inside of your account, but it does protect against other cracking or phishing schemes, such as if you click on a link and the hacker gains access to your password by tricking you into giving your information to them, or if they are successful in brute-forcing your account.

Some key points:

1. If your account is already broken into, it's hard to protect it
2. 2FA won't help against this type of attack, but can protect against fake websites and brute-forcing