Zero Breach Toolkit: A Spyware Scan That Stays Offline

By Indie Kings | November 2, 2026

Updated November 2, 2026: Zero Breach Toolkit is a free, open-source scanner for traces of Pegasus, Predator, Graphite, Candiru and other mercenary spyware on Windows, macOS, Linux, Android collections and iPhone backups. Version 2 ships as a double-click app in 27 languages, scans offline, and now refuses to call a device clean when parts of the check could not run.

Image: GitHub social preview card for the Zero Breach Toolkit repository.

What the toolkit checks

Zero Breach Toolkit is a consumer-facing scanner built on the earlier Zero Breach project. Its README describes it as a read-only check for traces of known mercenary spyware. It does not remove files, change settings or upload evidence. It writes temporary database snapshots and the reports the user asks for.

The scope is wider than a browser-history scan. On Windows it reads browser histories, cookies, connection records, bookmarks, downloads, site storage and caches across Chrome, Edge, Brave, Firefox, Tor Browser and other Chromium and Firefox variants. It also checks downloaded files, the Win+R box, antivirus status, Defender history, PowerShell logs, Prefetch, Amcache, DNS records, hosts files and startup or service registrations. On macOS it adds Safari history and iCloud tabs, LaunchAgents and LaunchDaemons. On Linux it reads common Snap and Flatpak browsers, autostart entries, systemd units and shell history.

Phones are handled indirectly. Android checks read a collection made with AndroidQF, the open-source acquisition tool from the Mobile Verification Toolkit project. iPhone and iPad checks read local Finder, Apple Devices or iTunes backups, extracted file systems and sysdiagnose archives. The toolkit never talks to the phone itself. That is a real limit: an Android check sees only what the collection contains, and an iPhone backup cannot show every trace.

The indicator library is the core of the product. The README says the toolkit uses about 13,300 published indicators from 29 downloadable sources and two built-in sets, plus about 900 file fingerprints and Android package names. The sources include Amnesty International's Security Lab, the Mobile Verification Toolkit project, the Citizen Lab and Echap's stalkerware research. A curated set covers Candiru and Paragon's Graphite, with every line cited. A second built-in set covers spyware families used against journalists, activists and minorities, drawn from ESET, Volexity, Cisco Talos, Meta, Unit 42, Lookout and Amnesty International.

The phone checks also look for signs of Cellebrite, the forensic tool used by police and security services to unlock seized phones. On Android, the toolkit looks for the fake USB devices Cellebrite hardware imitates in the phone's logs. On iPhone, it looks for crash traces and identifiers published by the Citizen Lab. These are published traces, not a general infection test, and the README says the phone keeps some records for only a limited time.

The green result problem

The indicator count is the headline number. The handling of a clean result is where the project differs from most scanners. The README says a green result is good news, not a guarantee. It means the check found none of the published traces it looks for, in the places it could read. It cannot find spyware nobody has published traces of, and it does not prove a device is safe.

That distinction became concrete during the version 2 launch. Version 2.0.0 shipped on November 1 as a double-click app for Windows, macOS and Linux. Within hours, the project shipped 2.0.1 to fix encrypted iPhone backups that could not be opened and could then show a clean result. Version 2.0.2 fixed a crash when the window could not open. Version 2.0.3 addressed a broader problem found in code review: some results said more than the check had done.

The 2.0.3 release notes are unusually direct. They say a phone nothing could be read from could show green, including an empty folder when a phone type was chosen, a damaged sysdiagnose, or an Android collection with an empty app list. The fix makes green mean nothing matched and every check ran. If some checks could not run, the window now says "Nothing found in what could be checked" in a neutral color and lists the gaps.

That is the failure mode the category has to guard against. A scanner that reports green when it read nothing is worse than no scanner, because it can create false confidence. The project found the problem, published it, and told users who had checked a phone with 2.0.0, 2.0.1 or 2.0.2 to check again. Version 2.0.4 followed with fixes from real Mac and Windows runs, and a 2.0.5 pre-release landed on the morning of November 2 with a macOS download-record check.

The repo has 4,224 stars, 443 forks and 4 open issues. It is Apache-2.0 licensed and was created on October 25, 2026. The rapid release cadence is a sign of active maintenance, but it also means users should check the version before trusting a report. The latest stable release is 2.0.4, published on November 1. The 2.0.5 build is marked pre-release.

Offline by design, with limits

The privacy design is the second reason the project stands out. The README says ordinary scans make no network requests. Python network calls are blocked, redirected paths are refused, and there is no upload feature. The only network step is an optional indicator update, which downloads the published lists from a fixed set of sources. A separate version check can be disabled with the no-version-check option.

The toolkit is read-only. It does not modify source evidence or system settings. On Windows it does not need administrator rights. On macOS, Safari checks need Full Disk Access, and the report lists anything it could not read. The README is careful about the difference between a saved reference and a finding: a web page that mentions a spyware address is weak evidence, while a known spyware file on the machine is strong. The report gives each finding an evidence grade and puts uncertain items under "Worth a look."

The limits are equally explicit. The toolkit only finds published indicators. Spyware is often rebuilt for each target, and many traces expire within weeks. An Android check sees only what the collection contains. An iPhone backup cannot show every artifact. The README says the tool does not replace a forensic examination by experts, and it tells anyone who thinks they are being targeted to contact a digital-security helpline before running anything.

There is also a practical warning about antivirus software. The Windows and macOS programs are not code-signed, so SmartScreen and antivirus products may flag them. The project has applied for free code signing and publishes SHA-256 checksums, GPG signatures and GitHub build attestations. The README says a file from anywhere other than the official release page should not be run. That is the correct instruction for an unsigned security tool, and it puts the verification burden on the user.

Reports can contain sensitive data: usernames, profile names, file paths, browsing details, SMS senders and message excerpts. The README tells users to keep reports out of shared and synced folders. A separate share-json option writes counts, scope labels, the verdict and fixed advice without artifact text, indicator values or dates. That summary is for initial sharing, not forensic evidence.

How to run it

The easiest path is the version 2 app. Windows users download an executable, macOS users choose an Apple silicon or Intel disk image, and Linux users extract a tar.gz. The app opens a window, offers Quick, Standard and Full checks, and shows what to do next after the scan. The README says the programs are built by GitHub from the published source, and each release includes a public build record.

The terminal version is still available. It needs Python 3.8 or newer, runs from a clone, and exposes the same checks plus JSON output and script-friendly exit codes. The README recommends running from source for anyone who wants to see every line that executes. The single-file release build is generated from that source, and users can rebuild it and compare the SHA-256 hash.

Check	What it covers	Estimate
Quick	Browsers only	5 to 15 minutes
Standard	Browsers, apps, startup items, program files and out-of-date programs	15 to 20 minutes
Full	Adds web caches and more file types	30 minutes or more

The scan can be stopped at any time, and the toolkit keeps what has already been checked. That is useful on a slow machine or a large phone backup, but a stopped scan is not a complete one. The report lists what could not be checked, and the exit codes distinguish a clean result from a result with coverage gaps. No exit code proves a device is safe.

Phone checks need more preparation. Android requires Developer options, USB debugging and a separate AndroidQF collection. iPhone and iPad checks require a local backup, ideally encrypted, and the toolkit reads that backup on the computer. The README walks through both paths and warns that iOS and iPadOS do not let an app read other apps' data directly. The phone is never scanned on the device itself.

For anyone in a high-risk situation, the README's first instruction is the right one: get expert help before running a scanner. It lists the Access Now Digital Security Helpline, which is free and available 24/7 in many languages, and Amnesty International's Security Lab. A green result from any tool is not a substitute for that help.

FAQ

What is Zero Breach Toolkit?
A free, open-source scanner for traces of known mercenary spyware on Windows, macOS, Linux, Android collections and iPhone backups. It is built on the earlier Zero Breach project and released under the Apache License 2.0.

Does it upload my files?
No. The README says ordinary scans make no network requests and have no upload feature. The optional indicator update downloads published lists, and a version check can be disabled. Reports stay on the user's computer unless the user sends them.

Can it prove my device is clean?
No. It only finds published indicators, and it cannot find spyware nobody has published traces of. The README says a green result means nothing matched in the places the tool could read, not that the device is safe.

What was the green result bug?
In versions 2.0.0 through 2.0.2, a phone that could not be read could show green. Version 2.0.3 fixed it and told users to recheck. Green now means nothing matched and every check ran; gaps are reported separately.

Which phones are supported?
Android phones through an AndroidQF collection, and iPhone or iPad through a local backup, extracted file system or sysdiagnose archive. The toolkit does not scan the phone directly.

Is it safe to run?
It is read-only and designed to work offline, but it is unsigned, so antivirus warnings are expected. Download only from the official GitHub release page, verify the checksums or build attestation, and treat a report as private evidence rather than a clean bill of health.

Bottom Line

Zero Breach Toolkit is a free, open-source spyware scanner for computers and phone evidence, with about 13,300 published indicators, 29 downloadable sources, roughly 900 file fingerprints and support for Windows, macOS, Linux, AndroidQF collections and iPhone backups. Version 2 turns it into a double-click app in 27 languages and keeps ordinary scans offline. The repository has 4,224 stars, 443 forks and 4 open issues, and it is Apache-2.0 licensed.

The refusal to overpromise runs through the design. A green result is explicitly not proof of safety, and the 2.0.3 release fixed a bug that had let an unreadable phone show green. That is the kind of correction a security tool should make loudly. The remaining limits are real: published indicators only, incomplete phone coverage, unsigned binaries and reports that can contain private data.

Our take: this is a useful first pass for a journalist, activist or ordinary user who wants a read-only check without uploading a disk image to a company. It is not a forensic examination, and it is not a substitute for expert help in a suspected targeting case. Download it from the official release page, verify what you run, read the "what could not be checked" section, and treat a clean result as a reason to keep looking, not a reason to stop.

Sources

GitHub interplains/Zero-Breach-Toolkit README, scope, indicator sources, privacy, install steps, result meanings, limits and license, accessed November 2, 2026
GitHub releases v2.0.0 through v2.0.5, release notes and asset details, including the 2.0.3 green-result fix, accessed November 2, 2026
GitHub API metadata for interplains/Zero-Breach-Toolkit, stars, forks, open issues, creation date, last push, language and license, accessed November 2, 2026
GitHub commit history for interplains/Zero-Breach-Toolkit, commits through November 2, 2026, accessed November 2, 2026