This rule detects inbound email attachments that are PDFs with suspicious metadata and embedded OCR text designed as credential-phishing bait. It targets attachments where the PDF’s EXIF producer field contains only a version-like string (numeric and punctuation) rather than a software/product name, combined with default/anonymized metadata (title "untitled", creator/author "anonymous", or subject "unspecified"). It additionally requires OCR-extracted text within the PDF to prompt the recipient to open the document (matching a short phrase like open <something> document). The combination of an unnamed generation tool, placeholder metadata, and a lure prompt is characteristic of automated PDF-generation kits used in BEC and credential phishing campaigns. The rule relies on beta features for EXIF parsing and OCR text extraction, and notes that behavior may change. Detection methods include Exif analysis, OCR, and content analysis. Overall, the rule flags PDFs that appear auto-generated with minimal identifiable metadata and an open-document lure, delivered as inbound attachments.