Jeff Bruchado
Back to blog

Zero Breach Toolkit in 2026: How to Check Your Phone and PC for Pegasus-Style Spyware

Hello HaWkers, an open source project called Zero Breach Toolkit has crossed 3,000 stars on GitHub and landed on the trending repositories list with a straightforward promise: check, for free and without internet, whether your computer, your Android phone, or your iPhone backup carries known traces of mercenary spyware, the category that includes Pegasus, Predator, Graphite, and Candiru. It matches your data against roughly 12,400 indicators published by 29 sources, including Amnesty International's Security Lab and the Citizen Lab.

Have you ever wondered whether you could check your own phone without sending anything to any company? In this article you will understand what this kind of tool actually looks for, how to run the scan step by step and, above all, how to read the result without falling into either panic or false reassurance.

What Mercenary Spyware Is and Why It Is So Scary

Mercenary spyware is surveillance software sold by private companies, almost always to governments and agencies. What sets it apart from regular malware is the level: these products exploit unknown flaws (the famous zero-days), often through zero-click attacks, where the victim does not need to click on anything.

The best-known names:

  • Pegasus, from Israel's NSO Group, which became a worldwide story in July 2021 with the Pegasus Project.
  • Predator, linked to the Intellexa/Cytrox consortium.
  • Graphite, from Paragon. In June 2025 the Citizen Lab confirmed infections on the iPhones of two European journalists through an iMessage flaw that Apple had already patched.
  • Candiru, another Israeli vendor, with documented targets in several countries.

The key point is that these attacks are expensive and targeted. Journalists, activists, lawyers, politicians, and people close to them are the typical targets. That does not mean the average developer is a target, but it does mean that, if you work close to someone like that, the question "am I compromised?" stops being paranoia.

How Indicator-Based Detection Works

No free tool can "see" an unknown piece of spyware. What these tools do is look for indicators of compromise (IOCs): traces that researchers have already found on real victims and published. Typical examples:

  • domains used by the attack infrastructure;
  • process names that show up on infected iPhones;
  • hashes of malicious files;
  • package names of Android apps used as bait;
  • suspicious links received via SMS.

The logic is simple: if a domain from Predator's infrastructure shows up in your browser history, it deserves attention. Here is a didactic Python example of how a hash check works under the hood:

import hashlib
from pathlib import Path

# Set of SHA-256 hashes published as malicious (fictional example)
hashes_conhecidos = {
    "3f5a...e91c",  # in a real IOC the hash has 64 characters
}

def sha256_do_arquivo(caminho: Path) -> str:
    """Computes the SHA-256 by reading the file in chunks so memory does not blow up."""
    h = hashlib.sha256()
    with caminho.open("rb") as f:
        for bloco in iter(lambda: f.read(65536), b""):
            h.update(bloco)
    return h.hexdigest()

def verificar_pasta(pasta: str) -> list[Path]:
    """Returns the files whose hash matches a known indicator."""
    suspeitos = []
    for arquivo in Path(pasta).expanduser().rglob("*"):
        if arquivo.is_file():
            try:
                if sha256_do_arquivo(arquivo) in hashes_conhecidos:
                    suspeitos.append(arquivo)
            except PermissionError:
                # Files without read permission are skipped, and that must be reported
                continue
    return suspeitos

print(verificar_pasta("~/Downloads"))

Notice the except PermissionError. That detail is the heart of an honest tool: whatever it could not read has to show up in the report, otherwise "nothing found" sounds stronger than it really is. Zero Breach Toolkit does exactly that, and every report lists what went unchecked.

What Zero Breach Toolkit Checks

According to the documentation in the interplains/Zero-Breach-Toolkit repository, the tool runs on Windows, macOS, and Linux, requires Python 3.8 or newer, and is read-only: it changes nothing on the system and makes no network requests during the scan.

On the computer

The local scan looks at:

  • browser history, cookies, and cache;
  • downloads;
  • DNS records;
  • Prefetch and Amcache on Windows;
  • autostart items;
  • shell history;
  • system logs;
  • file fingerprints (hashes).

On Android

By default it does not connect directly to the device. It reads a collection made with AndroidQF, an extraction tool used in the mobile forensics ecosystem. That collection includes installed apps, install history, links received via SMS, and intrusion logs when they exist. There is also a --collect-android option for those who want the tool itself to do the collection.

On iPhone

For iOS, the source is the local backup made with Finder, the Apple Devices app, or iTunes, encrypted or not, plus extracted file systems and sysdiagnose archives. The documentation says the table layouts from iOS 15 through iOS 18 are covered by tests.

License and indicators

The code is Apache 2.0. The indicator files curated by the project are under CC0 1.0, meaning public domain. Lists downloaded with --update remain under the terms of whoever published them.

Step by Step: Running the Scan on Your Computer

First, clone the repository and, if you are going to analyze an encrypted iPhone backup, install the optional dependency with hash verification:

# 1. Download the project
git clone https://github.com/interplains/Zero-Breach-Toolkit.git
cd Zero-Breach-Toolkit

# 2. (Optional) dependency to read encrypted iPhone backups
#    --require-hashes guarantees the downloaded package is exactly the expected one
python -m pip install --require-hashes -r requirements-backups.txt

# 3. (Optional) update the indicator lists
#    This is the ONLY step that uses the internet
python -X utf8 scan/zero-breach-toolkit.py --update

The update is optional because the project already ships a curated set that works offline. Still, it is worth running: new indicators are published all the time, and the scan is only as good as the list it uses.

Then, the scan itself:

# Default scan (most complete)
python -X utf8 scan/zero-breach-toolkit.py

# Quick scan: skips file fingerprints
python -X utf8 scan/zero-breach-toolkit.py --quick

# JSON report to keep or process later
python -X utf8 scan/zero-breach-toolkit.py --json relatorio.json

# Minimal summary, meant to be shared with whoever is helping you
python -X utf8 scan/zero-breach-toolkit.py --share-json resumo.json

The -X utf8 flag forces Python to use UTF-8, which avoids errors with accented file names on Windows. By the way, on Windows you can simply double-click scan\run-scan.cmd.

A practical tip: run it the first time with --quick to get an overview quickly, then run the full scan while the computer is idle, because hashing every file is heavy on the disk.

Step by Step: Checking an iPhone

The iPhone is the most common case of interest, because that is where Pegasus and Graphite were documented in the most detail. The path is to make a local backup and point the tool at its folder.

# macOS: where local iPhone backups are stored
ls ~/Library/Application\ Support/MobileSync/Backup/

# Windows (PowerShell): default location of iTunes backups
# dir "$env:APPDATA\Apple Computer\MobileSync\Backup"

# Point the scan at the backup folder (replace with the real name)
python -X utf8 scan/zero-breach-toolkit.py --phone "~/Library/Application Support/MobileSync/Backup/00008110-XXXXXXXXXXXX"

Prefer an encrypted backup. It sounds counterintuitive, but an encrypted iOS backup includes more data (such as saved passwords, Wi-Fi settings, and health data), which gives the analysis more material. That is why the optional dependency from the previous step exists.

For Android, the flow is similar: you generate a collection with AndroidQF and pass the resulting folder to the same --phone parameter.

How to Read the Result Without Panicking

Here is the part that matters most, and the project's own documentation makes it clear:

  1. "Something matched" means "look closer", not "you are infected". A domain may have been reused, a process name may coincide, an old indicator may produce a false positive.
  2. "Nothing found" is not proof that the device is clean. The tool only finds what has already been published. A new piece of spyware, or a variant that changed infrastructure, slips right through.
  3. Read the section on what was not checked. If half of the data was skipped because of permissions or an unsupported format, the result is worth much less.

If you used --json, you can filter the report in the terminal. Since the exact format may change between versions, start by exploring the structure before building any filter:

# See the top-level keys of the report
python -c "import json; print(list(json.load(open('relatorio.json', encoding='utf-8')).keys()))"

# Or browse the file interactively, if you have jq installed
jq 'keys' relatorio.json

And what if something real shows up? The project's own recommendation is to seek specialized help before you start touching the device. Access Now's Digital Security Helpline assists journalists, activists, and human rights defenders free of charge. Wiping the phone on impulse can erase exactly the evidence an expert would need.

Zero Breach Toolkit vs MVT: What Is the Difference

Anyone following the topic already knows MVT (Mobile Verification Toolkit), created by Amnesty International's Security Lab and released in July 2021 alongside the Pegasus Project's forensic methodology. MVT is the technical reference in the field and is used by real researchers.

The difference lies in the audience:

Aspect MVT Zero Breach Toolkit
Focus iOS and Android Computer, Android, and iPhone
Audience Researchers and forensic experts Technical users and beginners
Interface Command line with subcommands (mvt-ios, mvt-android) Single script with simple options and a double-click shortcut on Windows
Indicators Forensic community sources ~12,400 indicators from 29 sources, including Amnesty, MVT, and Citizen Lab

In practice, Zero Breach Toolkit builds on MVT's work and packages it for more people. For a serious investigation, MVT and a forensic expert are still the way to go. For a first check, without sending anything anywhere, Zero Breach Toolkit lowers the barrier considerably.

If you want to strengthen other layers beyond detection, it is also worth reading about passkeys and passwordless authentication with WebAuthn, which closes one of the doors most used in account takeover attacks.

What This Teaches Those Who Build Software

Even if you never need to run this tool, the project carries engineering lessons that apply to any security system:

  • Read-only by default. A diagnostic tool that modifies the system destroys its own evidence.
  • Network off during analysis. This removes the question "where is my data going?", which is exactly the right suspicion for someone who believes they are being watched.
  • Honesty about coverage. Reporting what was not checked is more useful than a pretty green badge.
  • Dependencies with pinned hashes. pip's --require-hashes protects against supply chain attacks, a real risk for security tools.

That last point applies to any Python project. Here is how to generate a dependency file with hashes using pip-tools:

# Install pip-tools
python -m pip install pip-tools

# Generate requirements.txt with each package's hash from requirements.in
pip-compile --generate-hashes requirements.in

# Install requiring every package to match its recorded hash
python -m pip install --require-hashes -r requirements.txt

If someone publishes a tampered version of a dependency, the install fails instead of running unknown code on your machine.

Outlook: Detection for Everyone

The mercenary spyware market did not shrink after the scandals: names change, companies reorganize, and new flaws appear. At the same time, defense has become more accessible. Apple and WhatsApp now notify users when they detect state-sponsored attacks, labs like the Citizen Lab and Amnesty's publish open indicators, and projects like Zero Breach Toolkit turn that material into something anyone can run.

The limit remains the same: indicator-based detection is always chasing the attacker. Updating your system quickly, turning on iPhone Lockdown Mode if you are in a high-risk group, and rebooting your device often are still measures worth more than any single scan. The tool is a flashlight, not a shield.

Let's go! 🦅

📚 Want to Keep Up With What Is Coming?

This article covered Zero Breach Toolkit and how to check your phone and computer for Pegasus-style spyware, but the ecosystem changes every week and not everything becomes an article here.

On X I share what I am testing, behind-the-scenes looks at my projects, and news that shows up before it turns into a post.

Follow Me There

👉 Follow @jeffbruchado on X

💡 Daily content about development, career, and the tools I actually use

Comments (0)

This article has no comments yet 😢. Be the first! 🚀🦅

Add comments