Attachment: QR code link with base64-encoded recipient address

type.inbound
and 1 of (
  any(ml.nlu_classifier(subject.subject).intents,
      .name == "cred_theft" and .confidence == "high"
  ),
  body.current_thread.text is null,
  any($org_slds, strings.icontains(sender.display_name, .))
)
and any(attachments,
        (
          .file_type in $file_types_images
          or .file_extension in $file_extensions_macros
          or .file_type == "pdf"
        )
        and any(file.explode(.),
                any(recipients.to,
                    .email.domain.valid
                    and any(beta.scan_base64(..scan.qr.url.url,
                                             format="url",
                                             ignore_padding=true
                            ),
                            strings.icontains(., ..email.email)
                    )
                )
        )
)
and not profile.by_sender_email().any_messages_benign
and not profile.by_sender_email().solicited