Abstract: Methods, non-transitory computer readable media, and security management apparatus that retrieves a web page in response to a request for the web page received from a client device. Remote access trojan (RAT) malware detection source code is injected into the web page and the web page is sent to the client device in response to the request. The RAT malware detection client-side source code is configured to, when executed by a web browser of the client device, output an alert when a possible attack is detected based on monitored movement of a mouse pointer, key events, or executing animations. A determination is made when the alert has been received from the client device. A security action is initiated according to an established policy, when the determining indicates that the alert has been received from the client device.