This rule detects credential phishing embedded in inbound messages by requiring the thread to contain 1–9 links and to have a natural language understanding (NLU) indication of credential theft with at least a medium confidence. It then applies aggressive link analysis to the links in the thread, inspecting the redirect history for a query parameter that carries an obfuscated JavaScript payload. The payload leverages an onerror handler in combination with atob and decodeURIComponent to dynamically redirect the browser to a credential harvesting page, an evasion technique designed to bypass static URL scanning while still achieving credential theft. The detection relies on the NLU classifier (cred_theft intent, non-low confidence) and the link analysis results (redirect histories) to identify the obfuscated JavaScript redirect pattern. This targets web-based phishing scenarios where attackers attempt to harvest user credentials through deceptive redirects and JavaScript obfuscation, and is triggered by a specific chain of conditions across inbound messages and their embedded links.