Securityspywarepegasusprivacyopen-sourcepython
Zero Breach Toolkit is a free, read-only scanner that checks your computer and phone backups for Pegasus and Predator traces
The open-source Python tool compares Windows, Mac and Linux records, AndroidQF collections and iPhone backups against about 12,400 published spyware indicators, with network calls blocked during the scan.
Most of us will never be the target of a government-grade spyware kit. The README’s first warning is addressed to the people who are, “Journalists, activists, human-rights defenders and civil society,” and right after it comes a guide written for people who have never touched a terminal: “You need a Windows or Mac computer and about 20 minutes.” Linux gets its own set of steps further down, and the tested platforms list covers “Windows, macOS, Linux, Android (AndroidQF collections) and iPhone (local backups).”
Everything in this piece comes from that one source, the project’s own README, so read it as the maker’s description.
On Windows, “No administrator rights are needed.” The check reads the “Mark of the Web” stamp that records which website each downloaded file came from, past Defender detections, protection-off events and added exclusions, and the history of the Win+R box. That last one is there for a specific reason: it looks for “commands people were tricked into pasting by fake “verify you are human” pages.”
Phones go through the computer. For Android, the tool reads a collection made with the Mobile Verification Toolkit project’s AndroidQF collector. For iPhone, it reads a local backup, and the guide recommends turning on Encrypt local backup first, because “encrypted backups include more of the records this tool checks.”
What it compares all of that against is “About 12,400 published indicators from 29 sources: Amnesty International’s Security Lab, the Mobile Verification Toolkit project, the Citizen Lab and Echap’s stalkerware research,” plus a hand-curated set from Citizen Lab reports on Candiru and Paragon’s Graphite. The curated set ships with the tool. Pulling the full list takes a separate --update command, which the README describes as downloading “from a fixed list of official sources.”
I’d read the trust section before running anything, because the project is upfront about the uncomfortable part. “Made by archivegenocide,” the README says, and later, “The project is anonymous, so do not take its word for anything.” Instead of asking for faith, it gives you a way to check. The release file is built deterministically from the source, the README publishes its size and SHA-256 for v0.1.11, and you can rebuild it from the tag and compare. Releases are also GPG-signed.
There’s no signed Windows program, and the README explains why: “code-signing certificates require a named legal identity,” and an anonymous author can’t get one. Its advice is to run from source, where every line the tool executes is sitting in the folder you downloaded.
The README also tells the people most at risk to skip the tool entirely and call a human. “If you think you are being targeted right now, get expert help first,” it says, pointing to Access Now’s Digital Security Helpline, which is free and runs around the clock, and to Amnesty International’s Security Lab. It also says outright that the tool “does not replace a forensic examination by experts.”
A full report can contain usernames, file paths, browsing details and SMS excerpts. The --share-json option writes a stripped-down summary for passing along, and the full report belongs somewhere only you can open it.