Technical summary: This rule detects inbound messages that embed HTML links split by inline hidden <span> elements to obfuscate the URL and evade text-based scanning. It triggers when body.html.raw contains the literal fragment 'https:/<span' and a regex match for a hidden display:none span containing a 6+ character alphanumeric token, designed to appear as a legitimate link to the recipient. The technique is used in phishing lures impersonating HR/payroll communications (e.g., fake 401K enrollment notices, PTO balance alerts) from spoofed or unrelated domains to entice clicks. The rule is categorized as Credential Phishing, employing evasion and social engineering techniques, with detection methods including HTML analysis, content analysis, and URL analysis. It carries high severity for inbound messages due to the risk of credential theft or user interaction with malicious links. The rule is defined in link_hidden_span_split_url.yml.