1. A host system including at least one hardware processor configured to execute a security module, wherein: the at least one hardware processor comprises: a branch counter register storing a count of branch instructions occurring within a sequence of instructions belonging to a process currently being executed by the at least one hardware processor, a configuration register storing a first memory address, and a counter control unit connected to the branch counter register and to the configuration register, the counter control unit comprising hardware logic configured to: compare the count of branch instructions to a predetermined first threshold, in response, when the count of branch instructions exceeds the first threshold, compare the first memory address to a second memory address, wherein a selected instruction of the sequence causes the at least one hardware processor to execute code stored at a memory location indicated by the second memory address, and in response to comparing the first and second memory addresses, when the first memory address matches the second memory address, trigger a switch event causing the at least one hardware processor to switch from executing the process to executing an event handler routine; and wherein the security module is configured to: write the first address to the configuration register, and in response to the switch event, determine whether the host system is subject to a malware attack.