A malicious Chrome extension named 'EmailHelper' was detected exfiltrating sensitive email communications to an external server. The extension was installed by user 'jdoe' and was transferring data to IP address 185.199.108.153. The file 'extension_data.bin' was extracted and found to contain email content. The SHA256 hash of the extension matches known malicious signatures.