Zero Breach v0.1.8

Security and correctness update. Please re-download if you are on an earlier version.

Fixes

• Self-reported version corrected. v0.1.7's single file reported Zero Breach 0.1.6 because the version string had drifted in the build. If you are on v0.1.7, it does contain the security fix despite reporting 0.1.6 — identify it by its SHA-256. v0.1.8 reports its version correctly, and the build now derives the version from a single source and fails if it does not match the release being cut.
• Network paths refused in the download. The single-file build now refuses --iocs and --json paths that are not on a local disk (UNC and mapped network drives), matching the source CLI. This prevents a path supplied in someone else's instructions from making Windows open an SMB connection.

Carried forward from v0.1.7: PowerShell is resolved by its absolute System32 path and runs in a controlled working directory (the local executable-hijack fix reported by @okba14 in #7).

Verify your download

Expected SHA-256 of zero-breach.py:

74740af20f609f82dc6e50d66f234d0c39a20f516caa35731c2d19c11684ef44

SHA256SUMS.txt and its detached signature are attached, along with the signing key. See SIGNING.md for the full verification steps.

Zero Breach v0.1.7

Security update — please re-download.

This release fixes a local security issue reported in #7 (thanks to @okba14): the scanner invoked PowerShell by bare name, which was resolvable from the current working directory, so a file planted in the working directory could run in its place and forge scan results. PowerShell is now pinned to its absolute System32 path with a controlled working directory.

It also hardens report integrity — a report-line sanitiser, safe handling of nested JSON, a snapshot size cap, and stricter indicator-value validation — and adds a privacy note to every report.

If you are on v0.1.1–v0.1.6, please update.

SHA-256 of zero-breach.py:

9431426a940a3a9bdea617017030e0fa7b155693c3b2d25d97960d1eb262ae4e

Verify your download with the detached signature (zero-breach.py.asc) and the signed SHA256SUMS.txt; see SIGNING.md. Release signing key fingerprint: C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C.

v0.1.6 — COM paths and historical coverage

COM path detection and more accurate history reports

Fixed an optional-pattern detection gap for registered COM commands under folders whose names contain .exe, .com, .bat or .cmd. For example, C:\tool.exe\payload.bat -Embedding now points to payload.bat rather than stopping at the folder name. Commands are parsed as text and never executed; existing local-path safety checks remain.

Historical coverage statements now describe evidence examined by this scan. Unread or unavailable history is not described as absent, and one old record is not presented as continuous coverage.

Validation: 294 unit tests (one Windows symlink privilege skip), 32 source/download fixture runs, real optional engine, webpage setup and checksum checks, plus 122 broader simulated scenarios: 102 expected passes and 20 documented scope limits, with no unexpected issues. New OS inputs are controlled fixtures; this is not a real-world spyware detection-rate estimate.

Official publisher: ArchiveGenocide
Official repository: https://github.com/interplains/zero-breach
Scanner SHA-256: 09fba9710143c11465c1627a0399b34ad1ee9a49341eddaa7d4656d77bf5ec78

Verify zero-breach.py.asc and SHA256SUMS.txt.asc with the established ArchiveGenocide public key; see SIGNING.md.

v0.1.5 — Retained DNS history fix

Windows DNS history: scan saved events even when logging is off

Zero Breach now checks retained Windows DNS events when logging is currently disabled. Previously those saved events were skipped. The scan does not enable logging or change your settings.

Reports still warn that queries made while logging was off may be missing. Empty logs, unreadable events and records outside the read limit remain coverage gaps. A match is a DNS record, not proof of an infection.

Validation: 286 unit tests (one platform-specific skip), 30 offline source/download fixture runs, real optional pattern engine, webpage setup/checksum checks, and cross-platform CI. OS collectors in the new regression scenarios are simulated.

Official publisher: ArchiveGenocide
Official repository: https://github.com/interplains/zero-breach
Scanner SHA-256: 59811565be507c7d956e77f5f396b81545259c551fa9208d85654a01dec1048e

Verify zero-breach.py.asc and SHA256SUMS.txt.asc with the established ArchiveGenocide public key; see SIGNING.md.

Zero Breach 0.1.4

Zero Breach 0.1.4 improves two optional coverage paths without changing the ordinary scan's read-only, offline operation.

With --patterns, local files named by per-user Windows COM registrations are examined before the broad folders, within a 128-path safety cap. A registration is context, not a spyware detection; only a matching published Candiru file rule becomes a pattern finding. Explicit --pattern-path still scans only the selected path. Windows DNS history now reads up to 50,000 retained events (previously 20,000), and reports any older retained events that were not read as a coverage gap rather than implying a complete clean result. The tool neither enables DNS logging nor recovers events that were never retained.

The suggested larger file cap was not added: both published Candiru rules explicitly require files below about 1 MB, so scanning larger files could not make these rules detect them. The optional pattern engine still requires Python 3.9+ and the pinned YARA-X installation in the README; the default scanner needs Python 3.8+ and no added package. No match is not proof that a device is free of spyware.

Validation

• 277 local tests passed with the optional engine (one expected permission skip) and without it (eight expected skips).
• All 19 CI jobs passed on the frozen pull request: Windows, macOS and Linux suites, optional-engine jobs, smoke scans and reproducible build.
• A read-only check on a Windows machine found 19 eligible COM paths: 14 scanned, five oversized files reported as coverage gaps, and no matches. Synthetic tests covered a DNS match past the old 20,000-event cap and incomplete retained history.
• The signed scanner rebuilt byte-for-byte from merged source. An independent Astra review found no release blocker after CI passed.

Download and verify

Download zero-breach.py. Its SHA-256 is:

5ab89ef3dda3579dfc0b4930b0d66290fdc755611afd91e28c373e30fe9996cc

The scanner and the 15-file checksum manifest are signed with ArchiveGenocide's established key, fingerprint C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. Compare it with ArchiveGenocide's verification page and follow SIGNING.md. Both signatures verified using a public-only keyring; an altered scanner was rejected. Earlier releases remain available unchanged.

Zero Breach 0.1.3

Zero Breach 0.1.3 adds an optional, experimental Candiru file-pattern check to the existing scanner. The ordinary scan is unchanged and still needs only Python 3.8 or newer. With Python 3.9 or newer, install the pinned optional YARA-X dependency and run zero-breach.py --patterns to check selected local files against two published, attributed Candiru/DevilsTongue rules. Use --pattern-path ABSOLUTE_PATH to specify a file or folder; it can be repeated. The check reads bounded bytes and reports inaccessible or skipped locations as coverage gaps.

This can flag some known file patterns that an exact file hash misses. It does not inspect memory, detect arbitrary variants, establish active infection, or scan phones for Pegasus. A hit needs investigation; no hit is not proof that a device is safe. Historical AdFection indicators have the same limits described in the previous release.

Validation

• The final pull request passed all 19 CI checks: default tests and smoke scans on Windows, macOS and Linux; optional-pattern tests on all three; reproducible build.
• Local optional-engine suite: 269 tests, one expected platform skip. The existing default scan remains available without the optional engine.
• Inside a disposable, network-isolated VM, two hash-verified Candiru-tagged files matched. One was absent from the previous exact-hash list. A clean corpus of 226 Debian/Python files produced zero matches. This small validation set does not quantify sensitivity or false-positive rate. No malware sample is distributed in this release.
• Independent Astra code and signed-artifact review found no remaining blocker.

Download and verify

Download zero-breach.py. The exact scanner SHA-256 is:

1a1eb0e76cd2791349be9861840a5756940c3a950a134b5436bc7f9d1b50e3b8

The scanner and 15-file checksum manifest are signed with ArchiveGenocide's established key, fingerprint C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C. Compare it with ArchiveGenocide's verification page, then follow SIGNING.md. The released signatures were independently verified using a public-only keyring; an altered scanner was rejected.

For optional setup and safe interpretation, read the README and detection-upgrade notes. Source tag v0.1.3 points to merge commit 982c405bf0186d30d91c7d7635ad595be780b238; the signed scanner was rebuilt from the merged source with identical bytes. Previous release assets remain unchanged.

Zero Breach 0.1.2

Zero Breach now checks supported Vivaldi profiles and ships the expanded, source-reviewed Candiru/AdFection indicator set.

• Add Vivaldi browser profile discovery on Windows, macOS and Linux, including Linux Snapshot and Flatpak locations. Use the existing history, cookie, cache and storage checks; improve browser names in locked-database messages. Thanks to @NurAbir for PR #1.
• Embed 405 indicators, up from 338: 67 additional domains/hostnames from published research by Citizen Lab, Confiant, Microsoft, Avast, Google TAG and Amnesty Security Lab. Preserve source citations and distinguish historical infrastructure from current campaign evidence.
• Ship 291 domain/hostname blocklist entries. Exclude the broad bare adtimizer.co blocking rule while retaining specifically documented operational hosts and the scanner indicator. Do not block shared hosting parents or cloud-provider IP ranges.
• Preserve existing STIX identifiers and original publication timestamps. The legitimate vulnerable-driver fingerprint remains an investigation lead and is excluded from the active STIX detection feed.

Scope

This adds browser coverage and published indicators, not a new detection engine. File checks still contain one exact Candiru spyware-sample fingerprint and one separately classified legitimate vulnerable-driver fingerprint. No Pegasus detection, memory inspection, antivirus replacement or mobile collection is added. A match is not automatically an infection; a no-match result does not establish that a device is safe. Historical attribution does not prove a domain is currently malicious.

Validation

215 tests passed locally and in all nine Windows/macOS/Linux and Python 3.8/3.11/3.12 combinations. All 13 CI jobs passed, including three quick-scan smoke jobs and reproducible-build validation. Release CI results.

An official signed Vivaldi 8.2.4133.87 Windows build generated a disposable profile using a local test page. Source and single-file checks detected real history/cookie evidence, retained references as references and reported locked files as gaps. Full command-line negative and positive fixtures returned the expected exit codes and reports. All 358 profile files remained byte-identical after closed-profile scanning. Actual macOS/Linux Vivaldi installations were not exercised; those platforms have automated coverage.

Download and verify

Requires Python 3.8 or newer. Download zero-breach.py, verify it, close browsers, and run python -X utf8 zero-breach.py on Windows or python3 -X utf8 zero-breach.py on macOS/Linux.

Scanner SHA-256:

f12f4a8dd15b00e6f2d7997f238780e43e7d82b689c6dfd5f4544b5d899c1a69

The scanner and ten-file checksum manifest have detached GPG signatures from the established ArchiveGenocide key:

C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C

Cross-check the key fingerprint on ArchiveGenocide's verification page. See signature verification instructions. Signatures were independently verified using only the published public key; an altered-file fixture was rejected. Later development-branch indicator updates are not covered by this release signature.

Source commit: ab99c68c3998ce159255059bb9a1e7a1329981e8. Rebuild from tag v0.1.2, rather than a later development branch, to reproduce these exact scanner bytes. Previous release assets remain unchanged.

For earlier STIX imports, use adfection.withdrawals.stix.json only to revoke the previously exported legitimate-driver indicator; it is not an active detection feed. The removal instructions remain in the README.

Zero Breach 0.1.1

This patch corrects false alarms and cases where unreadable or malformed evidence could hide findings.

• Preserve findings through later module failures in the downloaded scanner.
• Report unreadable files, unsupported schemas, incomplete snapshots, and cleanup failures as coverage gaps.
• Keep saved references separate from connection evidence. DNS records do not prove endpoint contact; preloaded blocking rules are protective configuration.
• Match recommended next steps to the evidence and indicator role. Ad-network traces and legitimate-driver matches start with context checks; stronger findings recommend qualified help.
• Print full copyable evidence paths and place detailed findings below the DNS-history instructions.
• Reject known remote and redirected paths; disable network-capable certificate verification. Permit only verified macOS system directory aliases.
• Correct IOC freshness, atomic updates, export citations, and reproducible feed generation.

Scope

This release remains focused on AdFection/Candiru. The bundled file indicators contain one known spyware-sample fingerprint and one separately classified legitimate vulnerable-driver fingerprint. It does not add Pegasus detection or mobile forensic collection.

Correction for previous STIX imports

The legitimate driver hash 6a4875ae86131a594019dec4abd46ac6ba47e57a88287b814d07d929858fe3e5 is not spyware and is excluded from the active STIX feed. Existing users should process adfection.withdrawals.stix.json only with a STIX consumer that supports revocation, or remove these old objects explicitly:

• indicator--80275ed1-64f2-58c7-97dc-9cdacac0ff5d
• relationship--66b188af-2489-5b41-a84f-b90c34f5fc73

Do not use the withdrawal file as an active detection/MVT feed. Continue using adfection.stix.json for scanning.

Publisher signatures

The scanner and checksum manifest now have detached GPG signatures from ArchiveGenocide's established release key. The tested scanner bytes and existing checksum manifest are unchanged.

Full key fingerprint: C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C.

Cross-check the fingerprint on ArchiveGenocide's established verification page. Download zero-breach.py.asc and archivegenocide-signing-key.asc alongside the scanner. Inspect the public key fingerprint before importing it, then verify:

gpg --show-keys --with-fingerprint archivegenocide-signing-key.asc
gpg --import archivegenocide-signing-key.asc
gpg --verify zero-breach.py.asc zero-breach.py

SHA256SUMS.txt.asc signs the ten-content-file checksum manifest. See verification instructions. Later development-branch indicator updates are not covered by this release signature.

Validation

199 tests passed in all nine Windows/macOS/Linux and Python 3.8/3.11/3.12 combinations, plus three end-to-end quick-scan jobs and the reproducible-build job. CI results.

The actual standalone passed synthetic SQLite/hash/report/cleanup integration checks. Repeated builds matched, including a byte-identical build on Windows and Ubuntu.

Download and verify

Requires Python 3.8 or newer. Download zero-breach.py, verify its SHA-256, and open a terminal in the download folder. On Windows run python -X utf8 zero-breach.py; on macOS or Linux run python3 -X utf8 zero-breach.py. Use SHA256SUMS.txt for all asset hashes.

Standalone SHA-256: 9c947d6ba23f4308b4d1512596e44b2ec2b34c3cba4139b4cb4d8774e77d08aa

Source commit: 09585eaf14fcd3a5d0be36767bf6295889e7c575. Rebuild from this release tag, not a later development branch.

Close browsers before scanning for more consistent SQLite snapshots. Python socket/path guards are not an OS network sandbox; POSIX network mounts and concurrent filesystem changes require external isolation for a strict offline boundary. A result with no matches is not a clean bill of health.

Zero Breach 0.1.0

Zero Breach is a local, read-only scanner that checks a computer for traces of the AdFection / Candiru campaign — where an ad-tech firm used real-time ad bidding to deliver zero-click spyware to targeted people (The Citizen Lab, 2026; Recorded Future, CTA-2025-0805).

A clean result is not a clean bill of health. Spyware of this grade is built to defeat exactly this kind of after-the-fact check, most of the traces it leaves expire within weeks, and Windows does not record DNS history unless you turn it on. If you have real reason to believe you are a target, contact the Access Now Digital Security Helpline or the Amnesty International Security Lab — not a self-service tool.

Run it

Needs Python 3.7+ (free from python.org — tick "Add python.exe to PATH"). No administrator. No third-party packages.

python -X utf8 zero-breach.py            # full scan, ~15 minutes
python -X utf8 zero-breach.py --quick    # faster, skips file fingerprinting

It only reads — it changes nothing, needs no administrator, and never touches the network (it will not even resolve an indicator). You can open it in a text editor and read every line first.

Windows gets every check. On macOS and Linux it runs the browser and file checks and reports the Windows-only checks as "not run" — never as clean.

Verify what you downloaded

Do not run a security script on trust. zero-breach.py:

SHA-256: 51cb9b38b9c136a3d57340460249d760450a62cc597cf0d77b2b507b28e2f720

Check it (Get-FileHash zero-breach.py -Algorithm SHA256 on Windows, shasum -a 256 zero-breach.py on macOS/Linux), or rebuild it yourself from source and confirm it matches — the build is deterministic:

git clone https://github.com/interplains/zero-breach && cd zero-breach
python build/build.py      # writes dist/zero-breach.py; its SHA-256 matches the above

Also in this release

DNS/ad blocklists of the campaign's domains, for a phone's or router's filter (Pi-hole, AdGuard Home, NextDNS, uBlock): adfection.hosts.txt, adfection.adblock.txt, adfection.dnsmasq.conf, adfection.domains.txt. And the indicator set as STIX and MISP feeds (adfection.stix.json, adfection.misp.json) — the STIX file works with Amnesty's Mobile Verification Toolkit for checking a phone backup.

338 indicators. Software: Apache-2.0. Indicator data: CC0 (public domain). Not affiliated with, or endorsed by, The Citizen Lab, Confiant, Recorded Future, Amnesty International or Access Now.