I get these spam emails from multiple accounts with only a few things in common. The messages include me and several other recipients in the To field (4+) They all have pdf attachments Always sourced from a different gmail account. All recipients are also gmail accounts.

I've been hacking at some gmail code but really do not know what I'm doing.

I created a filter that labels all emails with pdf attachments as "pdf"

My pseudo logic:

For messages labeled pdf { if number of recipients >= 4 mark it as spam }