Detects inbound emails with PDF attachments whose metadata (creator/producer) indicates generation by wkhtmltopdf or Qt-based tools, a pattern commonly used in malicious PDF creation. The rule OCRs the PDF content and applies a natural language classifier to identify credential-theft intents with sufficient confidence. It also analyzes URLs embedded in the PDF for suspicious patterns, such as very short paths (length of 2) or OAuth redirect parameters (redirect_uri present), which are often abused for credential phishing. If all conditions are met, it raises a Credential Phishing alert. Detection methods include Exif analysis, OCR, NLU, URL analysis, and file analysis.