Attack vectors on Yubikeys?

I’m looking into what possible ways could yubikeys be bypassed, hacked, or tricked.

My understanding is that Yubikeys have credentials bound to the URL of registration, meaning a phishing site would not be able to pull credentials if the user is tricked.
Now I’m wondering, is there a way to “trick” the yubikey into thinking your website is the actually one tied to the account? (Dunno, DNS spoofing/poisoning?)

What happens if it gets stolen? (I know if you have them …

attack attack vectors credentials cybersecurity hacked phishing registration thinking understanding url yubikey