Comment by delusional

The attacker would just ask you for the TOTP code and forward that to Google.