Zero Breach Toolkit: a free, offline check for Pegasus-style spyware on your laptop and phone backups

Mercenary spyware like Pegasus, Predator, Graphite and Candiru is usually discussed as something only forensic labs can detect. Zero Breach Toolkit, one of this week's fastest-rising repos on GitHub, puts a first-pass check in anyone's hands — and does it entirely offline.

What it does

It compares artifacts on your machine — browser records, downloaded-file origins, system logs, startup entries, DNS and hosts files, shell history and more — against roughly 12,400 published indicators of compromise from 25 sources, including research on stalkerware.

It covers:

• Windows, macOS and Linux computers (on Windows it also checks PowerShell logs, Prefetch and Amcache).
• Android, via AndroidQF collections: installed apps, SMS links, intrusion logs and signs of a modified phone.
• iPhone, via local Finder / Apple Devices / iTunes backups, extracted file systems and sysdiagnose archives.

Why it's well designed

• Read-only and network-silent. The scan makes no network requests. Internet is only used if you explicitly run --update to fetch the latest indicator lists.
• No dependencies, no admin rights. Python 3.8+ is all you need for ordinary scans.
• Honest output. Reports say what couldn't be checked, and a clean result is explicitly not presented as proof you're safe.
• Scan scopes (default, full, targeted, browser-only), a quick mode, and JSON or human-readable reports.
• An optional evidence bundle packages reports and chosen files for an expert — note it's unencrypted, so handle it carefully.

Run it

git clone https://github.com/interplains/Zero-Breach-Toolkit.git
cd Zero-Breach-Toolkit
python -X utf8 scan/zero-breach-toolkit.py --update   # optional: latest indicators
python -X utf8 scan/zero-breach-toolkit.py

On Windows you can double-click scan\run-scan.cmd. On macOS, give Terminal Full Disk Access first or some protected records will be skipped.

Read the results correctly

• A match means "look closer," not "you're infected." Indicator lists include domains and file names that can collide with innocent activity.
• It only finds published indicators. New or unpublished spyware won't show up.
• If you genuinely believe you're being targeted — journalists, activists, lawyers, officials — the project itself recommends contacting the Access Now Digital Security Helpline or Amnesty International's Security Lab first.

Licensing

Code is Apache 2.0; the curated indicator files and generated exports are CC0 (public domain). Some bundled research rules keep their own licenses, and lists downloaded via --update stay under their publishers' terms.

Our take

This isn't a replacement for professional forensics, and it doesn't pretend to be. But a free, transparent, offline first check — with clear warnings about its limits — is exactly the kind of tool that should exist. Worth a star, and worth running once on any device you're worried about.