Detects inbound messages that contain a PDF attachment which matches a known lure used in a fake remittance campaign. The rule activates on inbound data, then filters for attachments with a PDF file_type. It traverses nested file structures (file.explode) and applies a YARA scan; a match is required where the YARA rule name equals pdf_blue_remittance_lure. This ties the detection to credential phishing via a specific PDF-based social engineering lure and leverages both YARA signatures and general file analysis to identify the threat. The rule is rated medium severity and is aligned with credential harvesting tactics involving PDF-based social engineering.