FMail is a malicious browser extension deployed through BabyShark in CloudDragon activity. It modifies browser preference files, uses developer-tools functionality, retrieves JavaScript from command-and-control infrastructure, and steals webmail metadata, message content, attachments, and browsing history from supported services.