This phish tries to look like a collaboration request on for a document (transcript in this case).  The link goes to a document containing links to malicious sites posing as login pages.