[ziyo]

seriously... anybody?

[Binance]

Reactive phishing pages.
You obviously wont be able to brute them

[DramaKing]

Like TOTP or what do you mean?

[Fludems]

If you actually asked a question you'd probably get an answer

OTP can't be brute-forced, but as others have said, reactive phishing pages can work.

If you also have backdoor access to the users machine you can just cross reference the OTPs they've typed with the timestamp and figure it out that way, you can also social engineer it etc

There isn't any magical trick