1. A method for detecting malicious code in a rendered webpage, comprising: receiving, via a network by one or more hardware processors of a server, a request for a webpage from a user device; embedding, by the one or more hardware processors of the server, within the webpage (i) data indicating a plurality of elements that are expected to be rendered when the webpage is loaded and (ii) a malware module comprising software instructions that, when executed by the user device, cause the user device to identify a set of elements rendered at the user device based on the webpage, compare the set of identified elements to the plurality of elements that are expected to be rendered when the webpage is loaded to detect an identity of an anomalous element within the rendered webpage, and transmit the identity of the anomalous element to the server; communicating, by the one or more hardware processors of the server and via the network, the webpage having the embedded data and the embedded malware module to the user device; and in response to receiving, by the one or more hardware processors of the server from the user device via the network, the identity of the anomalous element that has been detected in the rendered webpage, limiting or denying access by the user device to the webpage based on the identity of the anomalous element.