As far as I know, this is why we use csrf (
Cross-site request forgery) tokens.
Theoretically, anything can submit POST data to a URL which accepts POST data...
dodgysite.com/login handles a POST request to log users in. All this site accepts is username / password. Any script should be able to send a request, including your phishing site.
securesite.com/login may in addition handle a unique csrf token, which wouldn't accept the request if the token doesn't match. As this token is randomly generated every time the login form is loaded, it would be impossible for a malicious actor to submit valid POST data from elsewhere.
In addition to checking each request for a valid csrf token,
securesite.com/login should also check the request comes from the same origin (ie, the legit login form on the website).
If these two requirements are not satisfied, then yes, you would be able to interact with the login form from a malicious application.