1. A method for protecting a digital data processing device from attack, the method comprising: within a virtual environment in at least one hardware processor: receiving at least one attachment to a first electronic mail; executing the at least one attachment; determining whether anomalous behavior occurs; and generating feedback when anomalous behavior is determined to have occurred; and receiving at least one attachment to a second electronic mail: receiving the feedback; and based on the feedback, performing filtering on the second electronic mail.