What you're describing is a different attack vector than phishing. I would describe it as malware. The classic phishing attack is to convince a target to visit a web page with a subtly different URL than the real thing, where they enter their credentials, which could include most second factors (OTP codes or push notifications). With U2F however, the browser will pass the URL of the requesting site to the U2F token, and that will be signed by the U2F token. The resulting signature cannot be used to login to the real service. You have to own the user's device or browser in order to do a phishing attack with U2F. And if you own the device or browser, it's probably easier to steal the short lived session auth credentials than it is to man in the middle U2F. You are correct, however, that U2F is not resistant to malware. Unfortunately, nothing really is, and it's not an easy problem to solve.