A new computer, and also every 30 days or if it detects something "suspicious." So, no, it wouldn't seem that unusual to be prompted to login again.

It's definitely suspicious. However, often it's not enough to trigger any alarm bells. It's fairly easy to mindlessly type in password/2fa codes into a website ("stupid google asking for my password again") rather than automatically think about a potential phishing attack.

While I haven't see it reported whether or not they had 2fa enabled, we can hope that they had taken this very basic security measure.

Actually one of the best preventions against this is using a password manager. I was nearly caught by a phishing site once, and I only noticed because 1Password was refusing to autofill the password field.

Not only is it possible, it really isn't very hard to execute. It takes some basic web programming skills. It's been seen in the wild: https://www.schneier.com/blog/archives/2009/09/hacking_two-f...

I haven't been targeted by one myself, but I've definitely heard of it happening. When the stakes are this high (million dollar+ payouts), attackers spend months infiltrating organizations, and adding 2fa to what is already a custom spear phishing page is not that much of a hurdle.