It sounds like you are worried that your users enter their credentials on another page than your real login page. In your case this is because the web application is hacked, but this is more commonly achieved by phishing attacks, so you may want to look into solutions against phishing.
There are a couple of ways to ensure users only authenticate on the correct domain:
- U2F hardware tokens. This is a USB dongle with a cryptographic key on it.
- Using a password manager that only autofills credentials when on the correct domain.
- Training users to recognize phishing pages, such as checking the URL.
Edit: Using two-factor authentication such as TOTP or SMS tokens don't prevent phishing, since the phishing page can also ask for these. It makes it a little bit harder since the attacker can only log in once with the captured credentials.
U2F is different in this respect, because of crypto. The token creates a signature of the domain name. The captured credentials only work on the phishing page and not on the real login page, so the attacker can't log in.