1. A method for detecting malicious network content by a network content processing system, comprising: receiving an electronic message; determining that the electronic message includes content determined to be suspicious; executing the suspicious electronic message content in a virtual environment; and identifying the suspicious electronic message content as malicious based on execution of the suspicious electronic message content in the virtual environment.