Google Drive shared-file lure behind a Turnstile gate, leading to a fake Google sign-in relayed to the operator

A fake Google Drive "Document shared with you" page asks the visitor to pass a Cloudflare Turnstile check before signing in to view the file. Past the check, a copy of the Google sign-in page passes the email address and password on to the operator while the victim types, so the operator can sign in to the real account during the same visit. Links are prepared per recipient: the email address is carried in the link, filled in and submitted automatically. The kit has run on pdfdocusignersdocument[.]info. A match means a page carrying the kit's gate or its sign-in pages, or a scan of one of its known hosts.