Software-exploitable Hardware Trojan Horses (HTHs) can be inserted into commercial microprocessors allowing the attackers to run their own software or to gain unauthorized privileges. As a consequence, HTHs should nowadays be considered a serious threat not only by the academy but also by the industry. In this paper we present a hardware security checker for the detection of the runtime activation of HTHs. In particular, we aim at detecting HTHs that alter the expected execution flow by launching a malicious program. To achieve this goal the proposed checker is connected between the microprocessor and the main memory and observes the fetching activity. We integrated the proposed checker within a case study based on a RISC-V microprocessor running a set of software benchmarks. The experiment demonstrated that our checker is able to detect 100% of possible HTHs activations with no false alarms. We measured an area overhead of less than 1% w.r.t. LUTs and FFs with 8.5 up to 9.5 BRAM blocks required, a 2.51% power consumption increase, and no working frequency reduction.