This Google Apps Scripts filter will automatically move all future emails with the header
- Go to Google Apps Script
- Add a new script and copy paste the content from the sibling file
- Test run the script, go to View in the menu bar and click Logs
- If there's no errors it should be blank, OR a verbose message that it removed a phishing email.