Microsoft-styled 'Document Access Required' email gate — page content

Pages styled as Microsoft that say 'Document Access Required' and ask the visitor to verify their identity before viewing a shared document. The page shows a fake device panel (browser and version, operating system, the visitor's time-zone city, 'Access Level: Standard User') and a 'Verify Your Email' box, and it also reads the victim's address straight from the link it was sent in, including addresses hidden in base64 or hex. After a fake 'Verifying access permissions' progress bar it forwards the address to a second site that imitates a Microsoft or webmail sign-in page to steal the password. Other versions titled 'Verification Required' or 'Installation Required' download a remote-access tool installer (ScreenConnect) presented as the document viewer, which gives the attacker control of the computer. The pages sit on short-lived two-letter subdomains of randomly named domains (e.g. bx.wsapbfy[.]net, yt.qbipchi[.]com, mirvok[.]vu) and on compromised or free-hosted websites, seen since at least early September 2026. Microsoft does not put shared documents behind such pages; genuine shared files open on sharepoint.com or onedrive.live.com after the normal Microsoft sign-in.