detects inbound email messages from external senders that include a PDF attachment generated with MuhammaraJS or Hummus-Recipe, identified via embedded EXIF/producer metadata. The rule targets PDFs masquerading as outstanding invoices or payment follow-ups and containing an embedded link to irs.gov/FormW9 to lend legitimacy via an official IRS form reference. It leverages EXIF data (producer/creator, Source-Producer), checks that the PDF is short (page_count <= 4), and uses OCR to search for indicative text such as irs.gov/form, “request for taxpayer”, “identification number and certification”, and variations of “form W-9”. This pattern is observed across many sender domains and spoofed invoice subjects, consistent with a shared PDF-generation toolkit used in business email compromise (BEC) campaigns. The rule uses beta features for EXIF/OCR extraction and notes that these features may change or be deprecated. Severity is high and the detection targets BEC/fraud through PDF-based social engineering and impersonation of brand legitimacy.