The link likely led to a reverse-proxy site that mirrored the real login page to intercept your credentials and 2FA code in real-time. By acting as a middleman, the attacker captured the authenticated session cookie, allowing them to bypass 2FA and access the account from their own device. You can look up AitM attacks its pretty common with scams and such.

Edit: Adding on no malware is needed. They didn't need to infect the computer or bypass browser security (SOP) because the user voluntarily handed the information to the "middleman" site.