1. A computer-implemented method comprising: obtaining, at a computer security system, content comprising first web code in an original form to be served to a first client device in response to the first client device requesting the content; modifying the first web code in the original form to first web code in a modified form in a polymorphic manner by making modifications to programmatic elements in the first web code that differ from modifications made to the first web code in response to one or more other client devices requesting the content comprising the first web code; providing the content comprising the first web code in the modified form to the first client device; receiving communications from the first client device, made in response to the first client device receiving the content comprising the first web code in the modified form; determining that code on the first client device, that was not served by the computer security system, attempted to interact with the content comprising first web code in the original form by calling a name of a programmatic element that exists in the first web code in the original form but not in the first web code in the modified form; in response to determining that code on the first client device attempted to interact with the content in the original form, determining that the first client device could be controlled by malware; wherein the method is performed by one or more computing devices.