1. A method comprising: obtaining at least a first software module not classified as benign or potentially malicious; extracting a set of features associated with the first software module, the set of features comprising one or more static features, one or more behavior features and one or more context features; computing distance metrics between the extracted feature set of the first software module and feature sets of a plurality of clusters, the plurality of clusters comprising: one or more clusters of software modules previously classified as benign and exhibiting a first threshold level of similarity relative to one another; and one or more clusters of software modules previously classified as potentially malicious and exhibiting a second threshold level of similarity relative to one another; classifying the first software module as belonging to a given one of the plurality of clusters based at least in part on the computed distance metrics; and modifying access by a given client device to the first software module responsive to the given cluster being one of the one or more clusters of software modules previously classified as potentially malicious; wherein the method is performed by at least one processing device comprising a processor coupled to a memory; and wherein extracting the set of features associated with the first software module comprises: extracting the one or more static features from the first software module; and obtaining the one or more behavior features and the one or more context features of the first software module from at least one of a plurality of client devices on which the first software module is installed.