1. A computer-implemented method for detecting phishing activity by determining a password used to decrypt an attachment of a communication message that is intended to be decrypted by a recipient of the communication message, the method comprising: in response to a communication message having an encrypted attachment, parsing content of the communication message and predicting a password candidate within a non-encrypted portion of the communication message by identifying a pattern of the content operating as a reference point in predicting the password candidate, wherein the pattern being one or more words and the predicted password candidate being (i) different than and distinct from the pattern and (ii) determined, at least in part, as a portion of the content that is within a predetermined number of words prior to or after the pattern of the content within the non-encrypted portion of the communication message; attempting to decrypt the encrypted attachment using the predicted password candidate to generate a decrypted attachment; and in response to decrypting the encrypted attachment using the predicted password candidate, performing a malicious content analysis on the decrypted attachment to determine a likelihood of the decrypted attachment containing malicious content, the malicious content analysis includes (i) determining whether data within the decrypted attachment exhibits characteristics associated with malware and (ii) processing the data within one or more virtual machines and observing behaviors occurring within the one or more virtual machines.