This rule detects inbound messages that carry a .gz attachment which, when expanded, reveals an email (EML) or HTML payload. It then analyzes the inner content for credential-theft intent. If the inner EML is well-formed, it parses the EML body text and runs an NLU classifier to identify a cred_theft signal with high confidence. If the EML is malformed, it extracts the HTML payload, harvests links (hrefs), performs link analysis on the URLs, and runs NLU on the resulting page text to detect cred_theft with high confidence. The rule uses archive and file analysis, YARA-based flavor checks (email_file or html_file), HTML and URL analysis, and NLP-based intent classification to catch credential-theft indicators embedded in attachments as a defense against credential-phishing attempts that evade simple filters.