Systems and methods to detect and neutralize malware infected electronic communications are described. The system receives, at a server, a request for interface information from a client machine. The system generates interface information. The interface information includes at least one input mechanism and countermeasure information. The at least one input mechanism is authorized for being included in a user interface to receive the user information at the client machine. The countermeasure information is for detecting whether the interface information is being modified to include an input mechanism that is not authorized to receive user information at the client machine. The system communicates the interface information, over the network, to the client machine.