Systems and methods detect and neutralize malware infected electronic communications. Interface information is received at a client machine over a network from a server. The interface information includes a first input mechanism authorized for causing a first prompt to be presented in a user interface to receive user information and countermeasure information enabling the client machine to inspect the interface information on the client machine to detect modification of the interface information. The client device uses the countermeasure information to detect whether the interface information has been modified to include a second input mechanism not authorized for causing a second prompt to be presented in the user interface to receive user information.