Zero Breach Toolkit Released: Open-Source Offline Mercenary Spyware Scanner
Zero Breach Toolkit is a free, open-source offline tool for detecting traces of known mercenary spyware on Windows, macOS, Linux, Android, and iPhone backups.
On October 28, 2026, Israel Exposed (@xIsraelExposedx) announced the release of Zero Breach Toolkit, a free, open-source offline utility designed to inspect devices for traces of known mercenary spyware, including Pegasus, Predator, Graphite, and Candiru.
Image source: Israel Exposed (@xIsraelExposedx)
Image Credit: Israel Exposed (@xIsraelExposedx)
The toolkit consolidates indicators across 29 external lists—including those from Amnesty International and Citizen Lab—totaling over 12,100 detection signatures, with active releases tracked on GitHub.
Offline Execution and Privacy Architecture
The Zero Breach Toolkit is designed to limit data exposure during security inspections.
- No Network Requests: The tool makes no network requests during a scan, blocks Python network calls, and has no upload feature.
- Read-Only Operation: It does not modify system settings or source evidence, writing only temporary database snapshots and requested reports.
- Minimal Privilege Requirements: Standard checks can run without root or administrator privileges, though some records may require elevated access.
Supported Platforms and Verification Workflow
The toolkit supports inspections across Windows, macOS, Linux, Android devices, and iPhone backups.
- Desktops (Windows, macOS, Linux): After installing Python 3, users execute the scanning script via terminal or batch files. On macOS, Full Disk Access may be enabled to inspect browser records fully.
- Mobile Devices (Android, iPhone): Android checks require enabling USB debugging via developer options, while iPhone inspections analyze an encrypted local backup generated via a computer (Windows or macOS).
Limitations and Caveats
The repository documentation states clear operational boundaries:
- Clean Result Scope: A clean scan indicates that no known indicators were found in accessible locations, but it does not provide definitive proof that a device is compromise-free.
- Expert Help First: Journalists, activists, and human-rights defenders facing active targeting are advised to contact the Access Now Digital Security Helpline or Amnesty International's Security Lab for expert assistance before relying solely on local scans.
Sources
- GitHub: interplains/Zero-Breach-Toolkit
- X (Twitter): Israel Exposed (@xIsraelExposedx)