Zero-Breach-Toolkit

A few updates from us: We have released v2 of our tool Zero Breach Toolkit, which now includes Windows, Linux, and MAC apps for those who were struggling with using the terminal and Python. You can download them here: interplains/Zero-Breach-Toolkit We have upgraded it to find more traces of israeli spyware (around 900 new fingerprints), and it can now check if your phone has had Cellebrite used on it, which is frequently used by governments when they seize your devices at border crossings. Report any issues to us on Github or Telegram. We have also finished adding 5,100 video to the archive, node map, and geolocation maps + expanded our whofundedgenocide.com to include more Brazilian entities trackced. God bless. Follow our backup @ZionismExposedx / @IsraelExposedAr We are now on Substack: substack.com

@radwanmortada Archive Genocide has released a new, open-source tool to detect Israeli spare. It takes a slight amount of technical knowledge to use, but is a tremendous weapon to fight the genociders. interplains/zero-breach-toolkit

Zero-Breach-Toolkit: free, offline, read-only scans for traces of Pegasus, Predator, Graphite and Candiru spyware on PCs, Android and iPhone backups. 3.7k GitHub stars. #infosec #opensource interplains/Zero-Breach-Toolkit

Zero-Breach-Toolkit — Pegasus等の傭兵スパイウェア痕跡を完全オフラインで検出！今週スター急増中のPython製ツール ・スキャン時の通信を徹底ブロック＆リードオンリー動作で安全に解析 ・PC全般からAndroid・iPhoneバックアップまで対応するクロスプラットフォーム仕様 ・社内PCや個人のセキュリティチェックを手軽に行い高度な標的型攻撃の早期発見に役立つ #セキュリティ #Python

barghest.asia many may have seen the famous Zero Breach Toolkit making ways across the internet (interplains/Zero-Breach-Toolkit). for me, countless messages were received from friends and colleagues about it. largely it has gone viral. in assessment, we can see that it is a clearly vibe coded wrapper around MVT toolkit, whilst pulling in sum 7k+ IOCs from various open source repos. it claims to detect traces of mercenary spyware; for clarity, it checks against historic IOCs related to mercenary spyware. tools like this align users with a false sense of security. they feel assured that if there are no IOCs flagged on their system they are safe. the transparency that technologist and analyst need to have around IOC decay and log retention in tools like this are ever more important. Zero-Breach-Toolkit's IOC data base is nearly 90%+ older than 2025. it has been long established by threat intelligence analysts globally that IOCs have a very small window of relevancy when live, threat actors will take down a c2 within hours - if you are lucky, maybe a day or two. using a no-longer active IOC for retrospective hunting has relevancy but only in bounds of the log retention made available by the operating system. you do have a a slightly larger window when used retrospectively,but you must recognize that endpoint logging systems are generally designed for operational diagnostics, not multi-year forensic retention. this is precisely why desktop monitoring EDR/SIEMs are big money, because businesses need to collected these logs at scale and store them for retrospective hunting (when used for security). without persistent collection or archival, log rotation and buffer limits mean historical evidence may be overwritten long before an historic IOC will ever be seen. this is to say that even IOC's from 3 months ago have a massive chance of being irrelevant simply because of device log retention. a scanner can only report on the evidence it has actually examined. if a database is unavailable or a log has rolled over the absence of a match tells you nothing conclusive about that evidence. Zero-Breach-Toolkit expresses it's effectiveness by it's IOC volume ("we trace 12400 signals of spyware"). IOC volume is a measure of collection size, not detection efficacy. without provenance, confidence, temporal context and an understanding of what each indicator actually identifies, a large database can create the appearance of coverage without actually demonstrating it. tools aimed at activists, journalists and civil society should make it easy to understand and fully transparent about it's capabilities and limitations. tools must demonstrate which sources were examined whilst also expressing which were not available. earliest and latest timestamps must be represented. IOC sources, when they were published and what versions were used must be shown. more importantly, what a negative result cannot establish.

We have released Zero Breach Toolkit, a free open sourced tool capable of detecting over 12,100 traces of Israeli & other spyware on your devices. It works on Windows, Linux, Mac, Android and Iphones. You can download it here: interplains/Zero-Breach-Toolkit

大家都以为手机、电脑被安装监控软件，要送到安全公司花钱检测才能查得出来。 结果有人把这套工具直接开源免费放出来，离线就能运行。 Windows、macOS、Linux、Android 手机、iPhone 备份都支持，专门检测已知商业间谍软件留下的痕迹。 GitHub 上已经有 3219 颗星了！ interplains/Zero-Breach-Toolkit

Did something stupid and am scared I ran this on my macOS and let it decrypt a full iPhone backup. I don’t know what I was thinking, I don’t have a lot of experience with this stuff github.com/interplains/Zero-Breach-Toolkit/commits I have been worrying myself sick that I uploaded my entire digital life to some scammer

Did something stupid and am scared I ran this on my macOS and let it decrypt an iPhone backup github.com/interplains/Zero-Breach-Toolkit/commits I don’t have any cybersecurity experience, I don’t know what I was thinking. It looked cool and I was under the influence I’ve been worrying myself sick that I gave my entire digital life over to some scammer

Very scared, did something stupid Hello, Stupidly I ran this GitHub on my macOS and gave it permission to decrypt my entire iPhone backup. Idk what I was thinking. github.com/interplains/Zero-Breach-Toolkit/commits Can anyone tell me if this was safe or did I unintentionally give over my entire digital life