Back to Documents Ready To Sign Scam Credential Harvesting

This is a version of Documents Ready To Sign Scam in Credential Harvesting.

Fake SharePoint shared documents page that asks for your email password to download business files

A page styled as Microsoft SharePoint shows a "Shared Documents" folder with five business files, such as product spreadsheets, a company profile and delivery requirements, each with a blue Download button. A notice above the files says they are "sensitive and secured" and that to open them you must "provide your correct email credentials" so the page can connect to "your email provider through a secured IMAP channel". It was first observed in India on November 2, 2026, at arch-zhp[.]pages[.]dev, a free Cloudflare Pages address that does not belong to Microsoft, and was seen three times that day.

Fake SharePoint shared documents page that asks for your email password to download business files | Screenshot

What’s different in this version

These traits set this message apart from the usual pattern.

  1. There is no document to sign. The lure is a set of order files from a supposed buyer or supplier: "Product quantity.xlsx", "Sample images", "Specific products, with detailed descriptions.xlsx", "Company profile.pdf" and "Delivery requirements.pdf", with sizes from 14.1 MB to 37.5 MB. This points at people in sales, purchasing or logistics who expect files like these.

  2. The page does not ask for a Microsoft account. It asks for the password of whatever email account you use, and gives a technical-sounding reason, an "IMAP channel", for needing it. Real file sharing never needs your email password.

  3. A "Login status: 0 attempts" line sits above the files, which suggests the page keeps count of the passwords typed in.

  4. The notice misspells "connect" as "conncet".

  5. The page is on arch-zhp[.]pages[.]dev, a free Cloudflare Pages address. It was seen three times within about two minutes on November 2, 2026, all in India.

  6. The password box that appears after a Download button is clicked, and where the details are sent, were not captured. How the link reached the person who found it was not recorded.

Other variations of this scam

Other reported versions of this scam.

Related scams

Other patterns in the same category, or that share a brand with this report.

How this scam works

  1. 1

    Step 1: An email claims a contract, invoice, or certificate is waiting for your signature.

  2. 2

    Step 2: The email includes a button like “Review Document” or “View Documents.”

  3. 3

    Step 3: The link leads to a fake login page (often Microsoft 365/Outlook or Google) on an unrelated website.

  4. 4

    Step 4: If you sign in, the scammers capture your password and may immediately try it on your email and other accounts.

  5. 5

    Step 5: Once in your inbox, they can reset passwords, read messages, and send new scams to your contacts.

✓ Do this

  • Open DocuSign or your e‑signature account by typing the official website address yourself (e.g., docusign.com).
  • Call or text the sender using a number you already know to confirm they sent the document.
  • Hover over links to check the real web address before clicking. It should match the real service (e.g., docusign.com).
  • Turn on two‑factor authentication (2FA) for your email and work accounts.
  • Report suspicious emails to your IT/help desk or email provider.
  • If you clicked and entered a password, change it immediately and sign out all sessions.

✗ Avoid this

  • Don’t open unsolicited documents or links.
  • Don’t click “Review” or “Sign” on unexpected emails, especially for payments or certificates.
  • Don’t enter your password on a page you reached by clicking a link in an email.
  • Don’t trust senders whose email ends in the wrong company domain (for example, not @docusign.com).
  • Don’t ignore small web address changes (e.g., random domains like example.live or misspellings).

Verbatim excerpts from the scam

Exact lines from emails or messages—searchable text so you can compare wording.

  1. 1 Excerpt 1
    Shared Documents
  2. 2 Excerpt 2
    These files are sensitive and secured against unauthorized access. In order to access this file, please provide your correct email credentials, we will conncet to your email provider through a secured IMAP channel to authorize your download.
  3. 3 Excerpt 3
    Login status: 0 attempts
  4. 4 Excerpt 4
    Product quantity.xlsx
  5. 5 Excerpt 5
    Specific products, with detailed descriptions.xlsx
  6. 6 Excerpt 6
    Company profile.pdf
  7. 7 Excerpt 7
    Delivery requirements.pdf
  8. 8 Excerpt 8
    Download