Attachment: QR code link with base64-encoded recipient address

type.inbound
and 1 of (
  any(ml.nlu_classifier(subject.subject).intents,
      .name == "cred_theft" and .confidence == "high"
  ),
  body.current_thread.text is null,
  any($org_slds, strings.icontains(sender.display_name, .))
)
and any(attachments,
        (.file_type in $file_types_images or .file_extension in $file_extensions_macros or .file_type == "pdf")
        and any(file.explode(.),
                any(recipients.to,
                    .email.domain.valid
                    and any(beta.scan_base64(..scan.qr.url.url, format="url", ignore_padding=true),
                        strings.icontains(., ..email.email)
                    )
                )
        )
)
and not profile.by_sender_email().any_messages_benign
and not profile.by_sender_email().solicited