This rule detects inbound emails with docx or pptx attachments that contain no text but exactly one embedded image. It then performs OCR/text extraction from the image and looks for a combination of callback phishing cues alongside brand impersonation signals. Key indicators include phrases related to purchases, payments, subscriptions, invoices, refunds, or antivirus renewals, paired with a phone number or monetary amount. It additionally requires impersonation of well-known brands (e.g., PayPal, McAfee, Norton, Best Buy) through obfuscated or non-obvious brand references. The rule only applies to emails from free email providers. Detection relies on file/content analysis and OCR to extract and analyze embedded image text. A successful match generally indicates a social-engineering attempt designed to drive the recipient to contact a scam line or provide payment details. The rule uses multiple corroborating signals (textual keywords, monetary/phone formats, and brand impersonation) to reduce false positives while enabling detection of image-based phishing that evades traditional text-based scanners.