Zero Breach Toolkit scans a laptop or phone for Pegasus spyware

A reporter or activist who thinks their phone is tapped used to have one option: send the device to a forensic lab. Zero Breach Toolkit is a free, open-source scanner. It runs on the person's own computer and checks for traces of known mercenary spyware. The repository has 1,441 stars and sits at number 9 on Trendshift's daily list.

The toolkit was published this month by a GitHub user named interplains. It is written in Python and released under the Apache 2.0 licence. The code is read-only on the computer it scans. It makes no network requests during a scan. The project page cites three indicator sources: Amnesty International's Security Lab, Citizen Lab and the Mobile Verification Toolkit project.

What it checks for

The scanner looks for signs of four named mercenary spyware families: Pegasus, Predator, Graphite and Candiru. It uses about 12,400 published indicators drawn from 29 public sources. The scan runs on Windows, macOS and Linux computers, on Android phones through AndroidQF collections, and on local iPhone backups. The project says a user without technical knowledge can run it, and the setup guide takes about 20 minutes.

The limits it names

The README states its limits in plain words. The tool only finds spyware that researchers have already published indicators for. New or unpublished spyware will not be found. A clean report is never presented as proof that a device is safe. The project page tells a reader who thinks they are being targeted right now to get expert help first. The scanner is not a replacement for a forensic examination.

How it compares

Amnesty International's Mobile Verification Toolkit, or MVT, has been the standard open-source check for mercenary spyware since 2021. MVT runs on iPhone backups and Android devices. Zero Breach Toolkit draws on MVT's indicator list and adds a desktop scan path for Windows, macOS and Linux. It also sits on a familiar install surface: a Python script that double-clicks on Windows and runs from the command line on macOS and Linux. The one-click Windows path is something MVT does not offer.

The audience

Mercenary spyware has been used against journalists, dissidents and lawyers in several countries. The research cited by Zero Breach Toolkit records this. The star count and the Trendshift ranking are the only real signals of adoption so far. A star count of 1,441 in three days does not say who added each star. Some stars may come from the reporters and activists the tool was built for. Others may come from readers who clicked without using it. The project's honest statement of what it cannot see is the stronger signal. A clean result that lists what it did not check is more useful than one that calls itself proof.

Source

Zero Breach Toolkit on GitHub.