Technical summary: This rule detects inbound email messages that attempt credential theft by spoofing Google's automated account security alerts. It triggers when the email appears to come from no-reply@accounts.google.com and the thread text contains a pattern in which the user is told to "generate this password for <app_name>, someone else might be using your account". The extractor captures <app_name> and then searches for a URL either embedded within that app_name or within the alert text. If a URL is found, it is normalized by prepending https:// and validated for a proper domain. If a valid domain is derived, the rule fires. The rule supports two malicious intents: a callback phishing flow and a credential phishing flow where victims are directed to attacker-controlled sites under the guise of securing the account. Attack types: Callback Phishing, Credential Phishing. Tactics and techniques: Impersonation (Brand), Social engineering, Spoofing. Detection methods: Natural Language Understanding, Content analysis, URL analysis, Sender analysis. The rule has medium severity and relies on content extraction, URL analysis, and sender verification to detect credential-theft attempts leveraging Google's alert branding. Note: legitimate Google alerts or atypical phrasing may generate false positives; consider corroborating with DMARC/DKIM checks and user awareness training to mitigate risks."