Cyberduck 7.7.0 and later support configuration of a jump-host, via a selective reading of your OpenSSH ~/.ssh/config file.  In particular, Cyberduck's implementation does not support the %h token or Match host stanzas used in the KB0014918 configuration to avoid repetition, so I recommend you prepend (so that it overrides;  alternatively, use without the KB0014918 configuration) duplicate but equivalent configuration that Cyberduck can successfully interpret, e.g.

# duplicate configuration for Cyberduck
Host ifarm
  Hostname ifarm.jlab.org.
  User lsh
  ProxyJump lsh@login.jlab.org.
# Final dot on `jlab.org.` necessary to avoid Cyberduck matching `Host *.jlab.org` later!

Then, when you enter ifarm for Server (no .jlab.org. unless you set Host that way -- you must enter it into Cyberduck exactly as you configured it in .ssh/config, no more, no less), URL should show the configured Hostname and Username should auto-fill.

Provide either your (CUE) Password or an SSH Private Key, and then Connect.  If you haven't saved it, you'll be prompted to accept login.jlab.org.'s host key fingerprint

and then to provide your two-factor credential (PIN followed by OTP, no spaces).  Be sure that you do not have Add to Keychain checked, lest Cyberduck try to use the one-time credential again and be unable to log in (in fact, I'd recommend disabling the feature under Cyberduck > Preferences > Connection > Use Keychain so you never accidentally leave Add to Keychain checked and have to go find and delete your no-longer-valid credential from Keychain).

As before with login.jlab.org., if you haven't saved it, you'll now be prompted to accept ifarm's host key fingerprint

and possibly, if you did not provide credentials previously, to enter your (this time, CUE) password

before being successfully logged on.