Detects inbound emails attempting VIP impersonation by abusing a forwarded-thread pattern around a past-due invoice. The rule looks for multi-thread conversations where the oldest thread is a forward to the VIP with a single recipient, and the next-oldest thread is FROM the same VIP. It enforces cross-thread recipient-format consistency between the forward and the VIP sender, and requires a mailto link authored by the VIP that points to an attacker-controlled address. The live message should route to that address rather than the VIP, with the VIP’s authoritative list-email not present among live recipients. It also requires that only a single organizational domain recipient remains, and that the message is not originated from the organization’s domain (or lacks DMARC authentication). This pattern aligns with invoice or overdue-account lures designed to hijack a thread and prompt fraudulent payment to a compromised account.