1. A method of identifying an electronic file as polymorphic malware, the method comprising: at a server, receiving from a client device a hash value and metadata associated with an electronic file; determining that the received metadata relates to corresponding metadata stored at a database, the corresponding stored metadata being associated with a further hash value that differs from the received hash value; determining that each of the received hash values have been reported by fewer than a predetermined number of clients; and as a result, determining that the electronic file is likely to be polymorphic malware.