interplains/Zero-Breach-Toolkit

What is it?

Key features

• 01Scans Windows, macOS and Linux computers for browser records, system traces and known file fingerprints.
• 02Checks Android phones from AndroidQF collections, including installed apps and SMS links.
• 03Reads iPhone local backups, extracted file systems and sysdiagnose archives.
• 04Runs read-only, with no network requests during a scan.
• 05Labels each finding with its evidence strength and lists checks that could not run.

Use cases

• Journalists or activists who want a first offline check of a computer or phone before seeking expert help.
• Security staff reviewing a suspicious device or collected phone backup.
• Researchers comparing device artifacts against published spyware indicators.

Quick start

1. 1

   Install Python from python.org

2. 2

   Download the project ZIP from the green Code button on GitHub and extract it

3. 3

   Run the scan from the extracted folder (macOS/Linux; on Windows double-click scan/run-scan.cmd)

   cd ~/Downloads/Zero-Breach-Toolkit-main && python3 -X utf8 scan/zero-breach-toolkit.py

Things to know

• !A clean result is not proof that a device is safe; the tool only checks published indicators and reports gaps.
• !Live Windows-only checks do not run on macOS or Linux.
• !Phone checks need manual setup steps on the phone and computer, and iPhone checks need an encrypted backup.

In collections

Topics

FAQ

What is Zero-Breach-Toolkit?

Offline scanner that checks Windows, macOS, Linux computers, Android collections and iPhone backups for traces of known mercenary spyware. Zero Breach Toolkit is a Python command-line tool that looks for traces of known mercenary spyware such as Pegasus, Predator, Graphite and Candiru. It checks Windows, macOS and Linux computers, Android phones through AndroidQF collections, and iPhone local backups or extracted file systems. It compares browser history, cookies, system records, file fingerprints, messages and other artifacts against about 12,400 published indicators.

Is Zero-Breach-Toolkit free to use? What license does it have?

Zero-Breach-Toolkit is open source under the Apache-2.0 license. Check the license terms before using it in commercial products.

Is Zero-Breach-Toolkit still maintained?

Actively maintained. The last commit to Zero-Breach-Toolkit was on Nov 5, 2026.

What can I use Zero-Breach-Toolkit for?

Journalists or activists who want a first offline check of a computer or phone before seeking expert help. Security staff reviewing a suspicious device or collected phone backup. Researchers comparing device artifacts against published spyware indicators.

How do I install Zero-Breach-Toolkit?

Install Python from python.org Download the project ZIP from the green Code button on GitHub and extract it Run the scan from the extracted folder (macOS/Linux; on Windows double-click scan/run-scan.cmd): cd ~/Downloads/Zero-Breach-Toolkit-main && python3 -X utf8 scan/zero-breach-toolkit.py

Where can I get Zero-Breach-Toolkit?

The source code and installation instructions are on GitHub: https://github.com/interplains/Zero-Breach-Toolkit