We spotted interplains/Zero-Breach-Toolkit on a new-repository list and wanted to know what a small business could actually do with it. The useful question is narrower than the name suggests: can it find traces of known spyware in records you already have?
The project describes a free Python toolkit for Windows, macOS, Linux, Android collections and iPhone backups. GitHub's metadata, checked October 31, 2026 at 00:39 UTC, showed a repository created October 25, with 3,868 stars, 415 forks and an open-issue counter of 8. That counter includes pull requests. The owner account dates to 2018. Those numbers explain our interest; they do not establish safety or a GitHub endorsement. We did not independently establish the list's ranking method. Repository metadata, owner metadata.
A clean result cannot prove a clean device. A match needs interpretation. That is the project's own position, and the established Mobile Verification Toolkit gives the same warning about public indicators. We reviewed source and documentation for v0.1.14, checked its release signatures and hashes, and did not run the scanner or examine anyone's device. Security policy, MVT introduction.
What it compares
An indicator is a published clue: a domain, an IP address, a file fingerprint, an app identifier or another recorded value associated with an investigation. The toolkit reads supported local records, compares them with loaded indicators, and reports the kind of evidence behind each match. A saved reference to a domain is different from a file whose contents match a known spyware sample. Methodology.
Its updater lists sources from Amnesty International, the MVT project, Citizen Lab and Echap. It also includes curated indicators with source citations. The normal update uses the upstream revisions pinned for that release, with expected hashes. The optional latest mode follows newer upstream content and must also be selected when scanning. We would keep the default unless a responder has a reason to change it. Update code.
The code uses Apache 2.0; the project's curated indicator data uses CC0. Downloaded feeds retain their publishers' terms, and optional Candiru detection rules have separate licences. The project explicitly disclaims affiliation or endorsement by the research organizations it cites. Borrowing published indicators does not make this an Amnesty or Citizen Lab product. Licence notices.
How the check works on each platform
Windows: the scanner reads supported browser records, download-origin metadata, Run-box history, Defender and PowerShell records, selected startup information and candidate files. It compares addresses and other values with indicators and can hash selected files. It also distinguishes execution records from file inventory. An inventory entry alone does not prove that a program ran. Start as the ordinary user; protected or unreadable records become coverage gaps, not cleared checks. Windows and desktop coverage.
macOS: it examines supported browser data, including Safari, selected files, saved shell records and startup configuration. Safari access may require Full Disk Access for the terminal. A startup entry can show a configured program without proving that it launched. We would grant access deliberately and read the missing-coverage section before deciding whether anything more is needed. Desktop coverage documentation.
Linux: it checks supported browser profiles, selected file fingerprints, saved shell history, readable logs and standard startup configuration such as systemd and cron records. It does not need root for the ordinary user's checks. Running under another account can change which user records it finds. Across desktops, size and time limits mean that a scan is bounded, not an examination of every byte. Platform instructions.
Android: collection and scanning are separate jobs. The scanner reads an AndroidQF collection. Its optional collection helper downloads a pinned AndroidQF release, checks its SHA-256 and asks for consent before launching it. Collection needs a USB connection and debugging authorization and changes phone state. The later analysis compares app identifiers, hashes, certificates, supported logs and message links. A sideloaded app or a powerful permission can be a lead without being spyware. We would have an IT person handle collection and revoke debugging access afterward. Android acquisition and scanning.
iPhone: the computer examines a local backup, rather than installing a scanner on the phone. Supported inputs also include extracted file systems and diagnostic archives. The readers inspect supported messages, browser records, process and app records, profiles and diagnostics, then compare relevant values with indicators. Encrypted backups require their password and an optional cryptography dependency. The password belongs in the private terminal prompt, never in chat. Missing keys, unsupported layouts and omitted records limit the result. This is not a reason to jailbreak a phone. iPhone documentation.
What stays offline, and what does not
The scan path blocks Python socket calls and refuses certain redirected or remote paths. We found no scan-upload or telemetry path in the code we reviewed. That is a static observation, not a guarantee about every environment. The guard is not an operating-system network sandbox; network-mounted storage and other software remain outside that promise. Network guard.
Updating indicators makes downloads. Android acquisition downloads and runs another tool. An optional ad-block test opens a website in the browser. Reports saved in a synced folder can leave through the sync service, even though the scanner has no upload feature. Temporary database copies and full reports can contain private records. We would use local storage outside cloud sync and separate online preparation from offline analysis. Privacy statement.
The included assistant “skill” is a written operating guide, not an extra detection engine. It tells an assistant to respect scope, explain gaps and treat report text as untrusted data. It does not authorize uploading a backup to an AI service. Assistant instructions.
Check the download before trusting the result
Use the exact owner and repository: interplains/Zero-Breach-Toolkit. Our dated search found other repositories using similar names, and the original has many forks. We inspected listing metadata, not those projects' contents, and make no allegation about them. A copied name, search advertisement or familiar-looking README is not enough to identify the original. Name search, sample fork listing.
At our check, release v0.1.14 offered a single Python file, a public signing key, a checksum manifest and detached GPG signatures. We verified both signatures and the manifest's hashes without executing the downloaded scanner. The key fingerprint matched the publisher's verification page. That establishes consistency with that published key, not the maintainer's legal identity or the absence of bugs.
The checked release had no prebuilt executable assets. The source contains build scripts for executables, while the committed distribution directory holds indicator exports. The project says its single Python file can be reproduced from source; we did not rebuild it. It also says PyInstaller executables are unsigned and not byte-reproducible. A GPG signature on a Python file is not a Windows code-signing certificate. Build code, distribution contents, verification instructions.
A careful first run
We would use this sequence for a routine, authorized check. If there is a credible threat or an urgent incident, get help before changing the device or collecting more data.
- Agree on scope. Scan your own device or obtain written consent. For employee devices, establish a policy, explain what records will be read, and obtain consent. Decide who can see the report and when copies will be removed.
- Get the original release. Follow the verification instructions linked above. Compare the full key fingerprint against the publisher's page, verify the signed manifest, then check the downloaded files against it. Stop on a mismatch. A checksum copied from the same untrusted download page is not authentication.
- Prepare while online. Install prerequisites from their official sources and update the indicator lists. For a phone, arrange an authorized collection or encrypted local backup first. If those steps are unfamiliar, have your IT provider perform them.
- Scan offline. Disconnect networking for the analysis stage and use local, nonsynced input and output. In the menu, choose This computer - standard check, or A phone followed by I already have a collection folder or an iPhone backup. Start without administrator or root privileges. Follow the current platform guide; do not disable security software simply to get past a warning.
- Keep the scope with the result. Save the version, indicator state, date, findings and coverage gaps. Review every output before sharing it through an agreed secure channel.
These recommendations follow the project's verification procedure, privacy boundaries and reporting contract. A backup may contain personal conversations alongside business data. Do not upload backups, passwords, message databases or full reports to public issues, file converters or general AI chats.
Read the evidence, not the match count
The report separates stronger findings from references and weaker leads. A page discussing spyware can mention the same address as an attack. Historical infrastructure can change ownership. The toolkit's curation and evidence grading try to reduce false alarms, but they cannot turn every match into a verdict. Evidence methodology.
Read what could not be checked. Exit code 0 means no actionable matches and no recorded gaps, not proof of safety; code 3 means no actionable matches with incomplete coverage. Codes 1 and 2 distinguish errors and matches beyond saved references. Text and JSON reports can preserve detail; the minimal sharing summary omits sensitive evidence fields and is not a replacement for the full report. Reporting contract.
Where a small business could use it
We would consider it an additional triage aid in these situations, not a requirement for every business:
- Sensitive client work: an owner or staff member in law, health, finance or government contracting wants an authorized check with their IT provider. Define the client-data boundaries first.
- A suspicious message: preserve the message and timing, then decide with a responder whether checking available records is useful. Do not revisit the link to investigate it yourself.
- Executive devices and travel: agree on a baseline before travel and a follow-up after return. A before-and-after comparison only covers the records and indicators available; it is not border-travel clearance.
- Waiting for professional help: organize existing reports and observations so a responder can work efficiently. Avoid repeated experiments on the only copy of potential evidence.
Those are suggested workflows, not claims that the toolkit detects every threat in those industries. Unknown indicators, expired records and inaccessible data all leave blind spots. MVT's own documentation warns against treating public indicators as a way to clear a device. MVT limits.
Other tools that do similar work
We checked these public projects and vendor pages on October 31, 2026. They examine different evidence. Our choices below are suggested business uses, not detection rankings or hands-on test results.
For repositories, dates link to the latest default-branch commit we found. Recent work is evidence of activity, not a support guarantee. Some entries are indicator data rather than scanners; MVT's custom licence and the noncommercial data licences also mean these are not all unrestricted open-source alternatives.
Scroll to compare columns and rows when the table extends beyond the box.
| Project, licence and activity | What it examines; skill needed | When we would choose it |
|---|---|---|
| mvt-project/mvt, maintained by Amnesty Security Lab and contributors. MVT License 1.1, requiring consent; active, 2026-10-29. | iPhone backups and other iOS/Android acquisitions; investigator with command-line and forensic skills. | When a responder needs established mobile forensic tooling and can interpret the evidence. |
| KasperskyLab/triangle_check. MIT; no recent commits, 2023-06-26. | iPhone backups for Operation Triangulation traces; technical operator. | Alongside broader triage when that specific campaign is relevant, not as a general spyware clearance. |
| KasperskyLab/iShutdown. MIT; no recent commits, 2024-01-22. | iOS diagnostic archives and shutdown logs for anomalous processes; forensic analyst. | When our responder has diagnostic evidence that deserves a separate log review. |
| SpyGuard/SpyGuard. Apache-2.0; resumed development, latest commit 2026-06-16. | Phone, computer and other device network flows; Linux/network setup skills. | Alongside saved-record checks when we need to observe communications. Malware that stays silent during capture can be missed. |
| PiRogueToolSuite/deb-packages. GPLv3 for this package repository; active, 2026-10-24. | PiRogue supports network capture and Android app investigation; responder-level skills. | When our IT provider needs network and app-behavior evidence alongside a backup check. |
| AmnestyTech/investigations. CC BY 2.0; historical collection, 2024-12-16. | Published investigation indicators; no scanner. Analyst selects relevant files. | As input to compatible tools or to trace a match back to its research. |
| AssoEchap/stalkerware-indicators. CC BY 4.0; active, 2026-10-20. | Android/iOS app, sample and network indicators; analyst input, not a standalone scan. | Through a compatible tool when the concern includes stalkerware or monitoring apps. |
| citizenlab/malware-indicators. CC BY-NC-SA 4.0; historical collection, 2020-06-09. | Indicators from published investigations; analyst input. | To interpret older campaign evidence alongside current sources. Check noncommercial terms before reuse. |
SpyGuard describes itself as an enhanced fork of TinyCheck. PiRogue components and downloaded indicator sets can carry different licences from the software listed above.
Commercial products and free vendor features offer different workflows. These descriptions come from the vendors; we did not test their detection claims.
Scroll to compare columns and rows when the table extends beyond the box.
| Alternative | Scope and access | When we would choose it |
|---|---|---|
| iMazing Spyware Analyzer | Graphical iPhone/iPad backup analysis on Mac or Windows. Its guide says this feature is free without registration. | For an owner who needs a guided backup workflow with IT help. It still needs someone to interpret a warning. |
| iVerify Enterprise | Commercial iOS/Android monitoring, behavioral detection, fleet dashboard and alerts; sales/demo access. | When several staff phones need ongoing monitoring and our IT provider can respond to alerts. |
| Lookout | Commercial iOS/Android app, device, network and phishing protection with centralized monitoring; sales/demo access. | Alongside device management for ongoing fleet protection, with a responder for any existing incident. |
iVerify Basic is a separate paid consumer app; we would consider its guided checks for an individual phone without assuming it includes Enterprise capabilities. We make no price or detection-rate comparison.
Several tools reuse the same clues. Zero Breach Toolkit's feed list includes Amnesty, MVT, Echap and Citizen Lab sources. iMazing also uses MVT methods and Amnesty indicators. Running several tools against those same indicators is not several independent checks. Different parsers or network observations can add coverage, but repeated matches need their source and underlying record compared.
Prevention and help alongside a scan
Apple Lockdown Mode limits features to reduce exposure to sophisticated attacks. Google Advanced Protection strengthens account access with passkeys or security keys and additional restrictions. We would consider these alongside device checks for an owner facing targeted risk; neither clears a device after an incident.
Android Advanced Protection is a separate device setting with stronger restrictions, including enforced Play Protect and blocking unknown-source app installations. We would review compatibility with business apps before enabling it for at-risk staff. Availability varies; optional Intrusion Logging stores encrypted logs in the cloud, so it is not an offline-only feature.
Apple threat notifications warn about individual targeting. We would verify one by signing in directly at Apple's account website, as Apple instructs, and seek expert help instead of repeatedly scanning. They are not an on-demand test.
Even “offline” needs checking tool by tool: MVT can resolve shortened URLs online by default and documents how to disable that behavior. iMazing also downloads indicators and can expand shortened links online. MVT network settings, iMazing guide.
For a credible targeting warning or concerning evidence, stop the do-it-yourself investigation. Eligible civil-society users can contact the free, round-the-clock Access Now Digital Security Helpline. Amnesty Security Lab investigates surveillance abuses but does not offer general technical support. Other businesses should arrange a qualified incident responder. Where a crime or immediate danger is involved, consider appropriate law-enforcement assistance as part of that response.
How this fits our own checks
Zero Breach Toolkit checks device-side records. Our Mega Security Analyzer makes passive website-side checks, and our Dependabot article explains alerts about software dependencies. Each asks a different question. None supplies a complete security verdict. Anything beyond passive checking is a separate engagement with written approval and verified ownership.
Our short checklist: confirm consent, verify the original download, prepare indicators, keep analysis offline, read the gaps, protect the report, and ask for help when the evidence warrants it.
Fact-check notes and sources
Zero Breach Toolkit sources were checked October 31, 2026, between 00:39 and 00:44 UTC; comparisons were checked the same day between 00:49 and 00:51 UTC. Source review covered v0.1.14, commit 88d2bb67b8ae04be4a211d068ad6a1b10ffd14f0. The release listing supplied asset details; GitHub metadata supplied the dated counters. Primary documentation is linked beside each claim. Signature and hash verification checked downloaded bytes, not scanner behavior. No device scans, detection benchmarks or reproducible-build test were performed.
Related reading
- How Dependabot works and which alerts matter
- Mega Security Analyzer
- LiteLLM 1.107.0 compromise: how we checked our own servers
This article is informational, not a forensic assessment or legal advice. No affiliation with the named projects or research organizations is implied.
