Zero Breach Toolkit: Is the New GitHub Spyware Checker Real and Safe to Run?

A free tool called Zero Breach Toolkit has been spreading fast on GitHub this week. It promises to check Windows, Mac and Linux computers, Android phones and iPhone backups for traces of mercenary spyware such as Pegasus, Predator and Graphite, entirely offline. Within three days it had thousands of stars.

Is it real, and is it safe to run? We looked at the project and read the code of its current release before writing this. Short answer: it is real and carefully built, but it is three days old and has not been independently reviewed. Here is what we checked, what we could not check, and the established alternative.

What Zero Breach Toolkit is

• Where it lives: github.com/interplains/Zero-Breach-Toolkit, released under the open-source Apache 2.0 license.
• What it does: looks for known signs of mercenary spyware: suspicious domains, file names, processes and settings that researchers have linked to these tools.
• Where its knowledge comes from: published indicator lists from well-known research groups, including Amnesty International's Mobile Verification Toolkit (MVT) project, Amnesty Tech, Citizen Lab and Echap's stalkerware list.
• Who makes it: a single maintainer account run by an activist archive group. It is not a security company, and the account has no track record in security tools.
• How new it is: the repository was created on October 25, 2026, and eleven versions were released in its first three days.

What we verified in the code

We downloaded release 0.1.10 and checked it against the checksum the project publishes. It matched. Then we read how it uses the network, because "offline" is the promise that matters most for a tool that looks through your files.

• The scan runs offline. The scanning code runs inside a guard called no_network that makes any attempt to look up a name or open a connection fail. That supports the project's claim that a scan sends nothing anywhere.
• Downloads happen only when updating. A separate update step fetches indicator lists, only from the research groups listed above, and checks each file against a fingerprint recorded in the release.
• The phone tool comes from Amnesty's project. For Android phones it downloads androidqf, a collection tool from the same project that maintains Amnesty's MVT, pinned to version 1.8.3 and checked against fixed fingerprints.
• Releases are signed. Each release ships with a PGP signature and a checksum file, and the project documents how to verify them.

What we could not verify

• The tool has not been independently reviewed. Our check covered how it uses the network, not every one of its 19,000 lines.
• It is three days old, maintained mainly by one person, and changing several times a day. Tools that new have not yet had time for others to find their mistakes.
• A clean result does not prove a device is clean. The project says this itself: it only finds known traces, and new spyware is designed not to leave them.

Should you run it?

Most people are not targets of mercenary spyware. It is expensive and usually aimed at journalists, activists, lawyers, officials and executives with access to sensitive information.

• If you are worried but not at high risk: keep your phone and computer updated, restart them after updates, and turn on two-step sign-in. That does more for most people than any scan.
• If you want to check a device: the established option is Amnesty International's Mobile Verification Toolkit (MVT), maintained since 2021 and used by researchers worldwide. Zero Breach Toolkit is built on the same indicator lists; if you try it, download it only from its GitHub releases page and verify the signature first.
• If you believe you are being targeted: do not rely on a self-check. Contact Amnesty International's Security Lab or Access Now's Digital Security Helpline, both of which help people at risk, and on an iPhone, turn on Lockdown Mode.

Why it matters for businesses

Spyware does not need to target a whole company. It targets the person with the access: the owner, the finance lead, the executive who travels. Their phone carries the company's email, files and passwords.

• Keep company phones and laptops on the latest updates, enforced, not just suggested.
• Use two-step sign-in everywhere, so a stolen password alone is not enough.
• Have a plan for the day someone says "I think my phone was hacked": who checks it, and what gets changed.

Zero Breach Toolkit questions people are asking

Is Zero Breach Toolkit real?

Yes. It is a real open-source project on GitHub, first published on October 25, 2026. Its release files match their published checksums and are PGP-signed.

Is Zero Breach Toolkit safe to run?

In our review of how it uses the network, the scan runs offline and downloads only during a separate update step, from named research groups. It has not been independently reviewed, so treat it as new software.

Does it send my data anywhere?

Not during a scan, based on the code we read: scanning runs inside a guard that blocks network connections. The update step downloads indicator lists but does not upload your data.

What is the difference between Zero Breach Toolkit and MVT?

MVT is Amnesty International's established tool, maintained since 2021. Zero Breach Toolkit is a new project that uses the same public indicator lists and adds checks for computers.

Can it detect Pegasus?

It can find known traces of Pegasus and similar spyware listed by researchers. It cannot prove a device is clean, because new spyware is designed to leave no known traces.

The bigger lesson

"Free security tool goes viral" is exactly the kind of headline attackers copy, so the habit matters more than this one tool: check who makes it, download it only from the official source, verify the signature, and prefer tools with a long track record for anything that reads your private files.

If you want your company's devices and accounts reviewed, see our security review and hardening service, or get a tech quote.

Sources: Zero Breach Toolkit on GitHub; Zero Breach Toolkit release 0.1.10; Amnesty International - Mobile Verification Toolkit; Amnesty Tech - androidqf.