This rule flags inbound messages from Zoho's meeting notification service when the message body (current_thread.text) is analyzed by an embedded NLU classifier and returns an intent named 'callback_scam' with non-low confidence (i.e., medium or high). It specifically matches emails sent from noreply@user.zohomeetingnotifications.eu and uses a logical any() check over the detected intents to trigger on the callback_scam signal. The combination of a verified sender and NLU-detected social-engineering callback phishing content constitutes a medium-severity detection for potential phishing attempts masquerading as legitimate meeting notifications. The rule leverages sender analysis and natural language understanding to identify suspicious patterns in notification content and is designed to reduce false negatives by requiring both a matching sender and a high-likelihood scam intent.