# Zero Breach Toolkit: a free, offline check for Pegasus-style spyware on your laptop and phone backups

> An open-source scanner compares your system against ~12,400 published indicators from 25 sources — without sending anything anywhere. What it can find, what it can't, and how to run it in five minutes.

Published Oct 30, 2026 by TechMeasured Staff · Repos · Canonical: https://techmeasured.com/repos/zero-breach-toolkit-offline-spyware-check

Mercenary spyware like **Pegasus, Predator, Graphite and Candiru** is usually discussed as something only forensic labs can detect. **Zero Breach Toolkit**, one of this week's fastest-rising repos on GitHub, puts a first-pass check in anyone's hands — and does it entirely offline.

## What it does

It compares artifacts on your machine — browser records, downloaded-file origins, system logs, startup entries, DNS and hosts files, shell history and more — against roughly **12,400 published indicators of compromise from 25 sources**, including research on stalkerware.

It covers:

- **Windows, macOS and Linux** computers (on Windows it also checks PowerShell logs, Prefetch and Amcache).
- **Android**, via AndroidQF collections: installed apps, SMS links, intrusion logs and signs of a modified phone.
- **iPhone**, via local Finder / Apple Devices / iTunes backups, extracted file systems and sysdiagnose archives.

## Why it's well designed

- **Read-only and network-silent.** The scan makes no network requests. Internet is only used if you explicitly run `--update` to fetch the latest indicator lists.
- **No dependencies, no admin rights.** Python 3.8+ is all you need for ordinary scans.
- **Honest output.** Reports say what *couldn't* be checked, and a clean result is explicitly not presented as proof you're safe.
- **Scan scopes** (default, full, targeted, browser-only), a quick mode, and JSON or human-readable reports.
- An optional **evidence bundle** packages reports and chosen files for an expert — note it's **unencrypted**, so handle it carefully.

## Run it

```bash
git clone https://github.com/interplains/Zero-Breach-Toolkit.git
cd Zero-Breach-Toolkit
python -X utf8 scan/zero-breach-toolkit.py --update   # optional: latest indicators
python -X utf8 scan/zero-breach-toolkit.py
```

On Windows you can double-click `scan\run-scan.cmd`. On macOS, give Terminal **Full Disk Access** first or some protected records will be skipped.

## Read the results correctly

- A **match means "look closer," not "you're infected."** Indicator lists include domains and file names that can collide with innocent activity.
- It only finds **published** indicators. New or unpublished spyware won't show up.
- If you genuinely believe you're being targeted — journalists, activists, lawyers, officials — the project itself recommends contacting the **Access Now Digital Security Helpline** or **Amnesty International's Security Lab** *first*.

## Licensing

Code is **Apache 2.0**; the curated indicator files and generated exports are **CC0** (public domain). Some bundled research rules keep their own licenses, and lists downloaded via `--update` stay under their publishers' terms.

## Our take

This isn't a replacement for professional forensics, and it doesn't pretend to be. But a free, transparent, offline first check — with clear warnings about its limits — is exactly the kind of tool that should exist. Worth a star, and worth running once on any device you're worried about.


## Sources

1. [GitHub — interplains/Zero-Breach-Toolkit](https://github.com/interplains/Zero-Breach-Toolkit)
2. [GitHub — Latest 10 trending repositories, October 30, 2026](https://github.com/marc-ko/daily-trending-repo/issues/594)