{"full_name":"interplains/Zero-Breach-Toolkit","owner":"interplains","name":"Zero-Breach-Toolkit","url":"https://github.com/interplains/Zero-Breach-Toolkit","description":"Free, open-source check for traces of mercenary spyware (Pegasus, Predator, Graphite, Candiru and more) on computers, Android phones and iPhone backups. Double-click apps for Windows, Mac and Linux, in 27 languages.","homepage":null,"topics":[],"language":"Python","license":"Apache-2.0","avatar":"https://avatars.githubusercontent.com/u/39777629?u=2813f6b5c3a17a862e070cd0e4e954a0c93bf8a5&v=4","created_at":"2026-10-25T14:41:34Z","pushed_at":"2026-11-05T14:13:44Z","metrics":{"stars":4630,"forks":486,"watchers":44,"issues":32,"prs":10,"releases":23,"issues_open":null,"issues_closed":null,"prs_open":null,"prs_closed":null,"prs_merged":null,"discussions":0},"growth":{"day":{"stars":27,"forks":2,"base_day":"2026-11-09"},"week":{"stars":372,"forks":39,"base_day":"2026-11-03"}},"history":{"dates":["2026-10-31","2026-11-01","2026-11-02","2026-11-03","2026-11-04","2026-11-09","2026-11-10"],"stars":[2698,3474,3826,4258,4346,4603,4630],"forks":[296,375,412,447,459,484,486],"watchers":[32,33,36,38,40,44,44],"issues_open":[null,null,null,null,null,null,null],"prs_open":[null,null,null,null,null,null,null]},"boards":{"weekly_rate":48,"monthly_rate":48,"new":153},"same_owner":[],"issues":[{"number":33,"title":"macOS test report for 2.0.2: false update warning and other findings","comments":5,"created_at":"2026-11-01T22:18:54Z"},{"number":39,"title":"Android collector with Pixel phone","comments":4,"created_at":"2026-11-03T14:34:46Z"},{"number":41,"title":"Multiple VirusTotal sandboxes are flagging this as malicious","comments":3,"created_at":"2026-11-04T17:34:02Z"},{"number":38,"title":"Windows 11 antivirus removing the executable","comments":2,"created_at":"2026-11-02T17:39:52Z"},{"number":40,"title":"Spyhound: an on-phone Android companion based on your detection logic","comments":1,"created_at":"2026-11-03T15:10:31Z"},{"number":37,"title":"Findings from testing 2.0.5 on a real Mac","comments":1,"created_at":"2026-11-02T13:34:28Z"},{"number":32,"title":"Version 2 is out","comments":0,"created_at":"2026-11-01T18:10:12Z"}],"discussions":[],"latest_release":{"name":"Zero Breach Toolkit 2.0.4","tag":"v2.0.4","published_at":"2026-11-01T23:27:05Z","body":"Zero Breach Toolkit 2.0.4. Fixes from real Mac and Windows runs. Thanks to the people testing it.\n\nIf you are on 2.0.0 to 2.0.2, please update, and if the window showed a phone as green, check it again: those versions could say more than the check had done ([2.0.3](https://github.com/interplains/Zero-Breach-Toolkit/releases/tag/v2.0.3) fixed that).\n\n**Mac**\n\n- **No more false \"macOS is out of date\" warning.** A date in a vulnerability record was being read as a version number, so every current Mac got it. Thanks to s3ba-b for finding it.\n- Safari folders that macOS refuses now give the plain privacy message, and the Full Disk Access advice is left out when access is already on.\n\n**Windows**\n\n- **Double-clicking no longer leaves a terminal in the taskbar**, which ended the check if you closed it.\n- The Quick check estimate is now 5 to 15 minutes, and connections that are closing are labelled \"System\" instead of \"System Idle\".\n- Chinese, Japanese and Korean use the matching Windows font.\n\n**Everyone**\n\n- The report's date comparison names the AdFection campaign, rather than implying the tool looks for only one campaign.\n- A check that does not apply says why in the report's detail.\n- A stopped check no longer says \"nothing matched\" in its next steps.\n- The saved report's location shows on the Result tab, and the save dialog lists file types.\n- Help scrolls and fills its tab, and Japanese and Chinese wrap correctly there. Right-to-left lines leave more room in small windows.\n\n**Your antivirus may flag these programs.** Antivirus products often wrongly flag new programs that are not code-signed yet, and some flag these. If you downloaded the file from this page, this is a false alarm and you can ignore it: the code is public, and each program has a public build record you can check. We have applied for free code signing and are reporting these false alarms to the antivirus companies. **If the file came from anywhere else, do not run it and trust the warning.**\n\nDownloads and first-launch steps: see the [README](https://github.com/interplains/Zero-Breach-Toolkit#easiest-download-the-program-no-python-no-commands). Full list: [CHANGELOG](https://github.com/interplains/Zero-Breach-Toolkit/blob/main/CHANGELOG.md).\n\n**Verify before running**\n\n`zero-breach-toolkit.py` SHA-256: `98279a7212220260f78e72020e52420565cc6c0c00f25bb02d478902288b80fc`\n\nEach program: `gh attestation verify <file> --repo interplains/Zero-Breach-Toolkit`. Their checksums are also GPG-signed: `gpg --verify SHA256SUMS-programs.txt.asc SHA256SUMS-programs.txt`, then `sha256sum -c SHA256SUMS-programs.txt`. Signed with key `C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C`.\n\n"},"readme":true,"readme_zh":false,"news":[{"title":"4,281 Star 的反间谍软件自查工具：Zero-Breach-Toolkit 让普通人也能检测 Pegasus 痕迹","url":"https://blog.csdn.net/weixin_43017921/article/details/169910423","source":"blog.csdn","lang":"zh","date":"2026-11-02"},{"title":"Ваш телефон чист? Не спешите радоваться, даже если проверка ничего не нашла","url":"https://www.securitylab.ru/analytics/579410.php","source":"SecurityLab.ru","lang":"en","date":"2026-11-01"}],"stale":false,"snapshot_at":"2026-11-10T09:35:25Z","history_start":"2026-09-06"}