I have several servers that run different security automations and email me on set intervals via cron. One of those processes is rkhunter which I run via a shell script using the --cronjob argument. Since I had set these up, the reports would come through but they would also show up as an attachment.
After playing with the shell script today, I finally found the problem. rkhunter uses cli colors ( as supported ) when displaying output of certain processes. These colors would get sent in the email and automatically handled by gmail to be an attachment (security procedure I'm guessing). By adding the additional argument
--nocolors, I am now able to send the output as plain text.
( /usr/bin/rkhunter --versioncheck --nocolors
/usr/bin/rkhunter --update --nocolors
/usr/bin/rkhunter --cronjob --report-warnings-only --nocolors
) | mail -s "rkhunter report" firstname.lastname@example.org