This rule detects inbound email content abusing a tag-splitting technique (CSS @import fragmentation) used by threat groups TA458 (RoundPress/SpyPress) and TA488 (Void Blizzard/ZimReaper) to deliver webmail-exploit payloads against self-hosted platforms such as Zimbra, Roundcube, mDaemon, SOGo, and Kerio. The technique relies on sanitizers stripping @import sequences, allowing the browser to reassemble a valid executable markup when the message is opened in a vulnerable webmail client (a half-click exploit). The rule covers payloads in both the message body and in HTML attachments and looks for: 1) base64-aligned payload fragments (e.g., zmb_pl_v and the trio em1iX3BsX, ptYl9wbF, 6bWJfcGxf); 2) @import patterns adjacent to tag/attribute names that indicate tag-splitting (e.g., <@import...); 3) a hidden SVG payload that decodes base64 on load using onload=eval(atob(...)); and 4) matching HTML attachments (.html/.htm/.shtml/.dhtml) containing the same indicators. The rule is triggered on inbound content and references public analyses and campaigns (Proofpoint/NSA/FBI) related to RoundPress and ZimReaper, including links to related advisories and indicators. Detection methods focus on HTML/content/file/Javascript analysis, with high-severity classification and an attack taxonomy aligned to HTML smuggling, evasion, and scripting-based exploitation.