This rule detects inbound messages that attempt to deliver phishing payloads via gzip-archived HTML or HTML-like content embedded in images. It flags two correlated patterns: (1) a gzip attachment that unpacks to an HTML file identified by YARA (html_file) containing a data:image URI, indicating embedded image-based content, and (2) a message body containing a base64-encoded image paired with an anchor tag styled as a rounded button. The anchor’s href is resolved to a domain that is valid. The goal is to hide malicious links within image-styled buttons or compressed HTML to evade traditional content filters. The rule leverages archive analysis to inspect compressed attachments, YARA to identify HTML payloads, HTML analysis to parse the document structure, URL analysis to validate domains, and file analysis to examine the original attachment. This combination targets HTML smuggling, image-as-content techniques, and evasion of filters used in credential phishing campaigns.