Detects inbound emails that contain at least one PDF attachment and a specific HTML formatting pattern in the email body. The rule requires an inbound context, at least one attachment with file_type 'pdf', and a targeted HTML structure within the body: a div containing a span with a bold element and a following-sibling span. It then validates that the HTML contains exactly two distinct rgb(...) color values in the raw content, indicating two color-emphasized segments. Within the selected HTML region, it looks for a span whose text ends with phrases like 'following code:', 'following password:', or 'following pass:' to signal the disclosure of a code or password. If all conditions are met, the rule flags Credential Phishing using HTML analysis, content analysis, and file analysis techniques. The approach leveragesColor-coded emphasis and bolded phrasing as social-engineering cues to prompt recipients to reveal a passcode or password. Potential limitations include dependence on a specific HTML structure and color-coding style, which may lead to false positives with legitimate communications that use similar formatting or two RGB values, and potential evasion if attackers modify the markup or color usage.