We have made a number of improvements supporting two factor authentication with one time passcode for SFTP. The latest minor update of Cyberduck 4.4 has been tested to work flawlessly with installations running the Google Authenticator PAM module with OpenSSH keyboard interactive authentication or similar setups.
Give it a try in the latest beta build available for Mac & Windows.
Update. Documentation now available in the wiki.