Zero Breach 0.1.2

Zero Breach now checks supported Vivaldi profiles and ships the expanded, source-reviewed Candiru/AdFection indicator set.

• Add Vivaldi browser profile discovery on Windows, macOS and Linux, including Linux Snapshot and Flatpak locations. Use the existing history, cookie, cache and storage checks; improve browser names in locked-database messages. Thanks to @NurAbir for PR #1.
• Embed 405 indicators, up from 338: 67 additional domains/hostnames from published research by Citizen Lab, Confiant, Microsoft, Avast, Google TAG and Amnesty Security Lab. Preserve source citations and distinguish historical infrastructure from current campaign evidence.
• Ship 291 domain/hostname blocklist entries. Exclude the broad bare adtimizer.co blocking rule while retaining specifically documented operational hosts and the scanner indicator. Do not block shared hosting parents or cloud-provider IP ranges.
• Preserve existing STIX identifiers and original publication timestamps. The legitimate vulnerable-driver fingerprint remains an investigation lead and is excluded from the active STIX detection feed.

Scope

This adds browser coverage and published indicators, not a new detection engine. File checks still contain one exact Candiru spyware-sample fingerprint and one separately classified legitimate vulnerable-driver fingerprint. No Pegasus detection, memory inspection, antivirus replacement or mobile collection is added. A match is not automatically an infection; a no-match result does not establish that a device is safe. Historical attribution does not prove a domain is currently malicious.

Validation

215 tests passed locally and in all nine Windows/macOS/Linux and Python 3.8/3.11/3.12 combinations. All 13 CI jobs passed, including three quick-scan smoke jobs and reproducible-build validation. Release CI results.

An official signed Vivaldi 8.2.4133.87 Windows build generated a disposable profile using a local test page. Source and single-file checks detected real history/cookie evidence, retained references as references and reported locked files as gaps. Full command-line negative and positive fixtures returned the expected exit codes and reports. All 358 profile files remained byte-identical after closed-profile scanning. Actual macOS/Linux Vivaldi installations were not exercised; those platforms have automated coverage.

Download and verify

Requires Python 3.8 or newer. Download zero-breach.py, verify it, close browsers, and run python -X utf8 zero-breach.py on Windows or python3 -X utf8 zero-breach.py on macOS/Linux.

Scanner SHA-256:

f12f4a8dd15b00e6f2d7997f238780e43e7d82b689c6dfd5f4544b5d899c1a69

The scanner and ten-file checksum manifest have detached GPG signatures from the established ArchiveGenocide key:

C24E C92B 12D6 670A 2516 065F 9B4D 5754 99AF A53C

Cross-check the key fingerprint on ArchiveGenocide's verification page. See signature verification instructions. Signatures were independently verified using only the published public key; an altered-file fixture was rejected. Later development-branch indicator updates are not covered by this release signature.

Source commit: ab99c68c3998ce159255059bb9a1e7a1329981e8. Rebuild from tag v0.1.2, rather than a later development branch, to reproduce these exact scanner bytes. Previous release assets remain unchanged.

For earlier STIX imports, use adfection.withdrawals.stix.json only to revoke the previously exported legitimate-driver indicator; it is not an active detection feed. The removal instructions remain in the README.