Detects inbound emails that are not replies/forwards and contain references to research, internship, or fellowship opportunities with weekly stipends, coupled with a PDF attachment whose OCR-extracted text confirms a research/internship role and cites a weekly dollar amount. The rule further checks for indicators that recipients should respond via personal free-mail addresses, text message, or an alternate email, which aligns with common fraud/scam patterns aimed at harvesting personal data or payment. Detection relies on: (1) subject/body keywords related to research/internship opportunities, (2) presence of a PDF attachment, (3) OCR-derived content within the PDF showing a research internship context and a weekly stipend, and (4) explicit contact channels that bypass corporate email controls (text, alternate email, personal providers). The rule is tagged for BEC/Fraud and Spam and leverages OCR, content analysis, and file analysis to validate the attachment’s content and the social-engineering setup, potentially enabling in-band (email) or out-of-band pivot indicators and highlighting use of free-email providers for contact.