What you need is that the use of credentials is bound to the accessed domain or that the actual credentials are not transferred at all.
On the client side this can be achieved by using a password manager which stores the credentials for the domain and will only fill in the credentials if it matches the stored domain.
From the perspective of the web application this can be achieved by using authentication with client certificates. In order to steal these the attacker would need to get access to the clients private key, which is only accessible on the clients system and can not be retrieved with man in the middle or credential phishing attacks. Also, modern authentication methods like WebAuthn provide a comfortable way for the user to authenticate (no password needed) and similar to client certificates makes it impossible for an attacker to steal the credentials with a phishing attack. Another method would be the use of the Digest Authentication built into the browser instead of creating your own login form. In this case no password is transferred but instead the client proves that it knows the password with some challenge-response method. Unfortunately the server has to store the plain password or some equivalent in order to verify the users response.