# 🛡️ Zero Breach Toolkit — the free 15-minute check for Pegasus traces on your phone

**URL:** <https://onehack.st/t/zero-breach-toolkit-the-free-15-minute-check-for-pegasus-traces-on-your-phone/327096>\
**Category:** Tools & Scripts\
**Tags:** tools, privacy, security\
**Created:** [November 8, 2026, 11:23am UTC](https://onehack.st/t/zero-breach-toolkit-the-free-15-minute-check-for-pegasus-traces-on-your-phone/327096 "2026-11-08T11:23:06Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![BlueHacker](https://onehack.st/user_avatar/onehack.st/bluehacker/32/174721_2.png) [@BlueHacker](https://onehack.st/u/BlueHacker)\
**Post date:** [November 8, 2026, 11:23am UTC](https://onehack.st/t/zero-breach-toolkit-the-free-15-minute-check-for-pegasus-traces-on-your-phone/327096/1 "2026-11-08T11:23:06Z")

</div>

![The phone's free smoke detector](https://onehack.st/uploads/default/original/3X/b/1/b1aa67b2839004f4804a9e63b59dfca0a3b6bcd5.jpeg)

## The spy leaves fingerprints. This reads them — free.

**Zero Breach Toolkit** checks Windows, Mac, Linux, Android and iPhone backups for 13,300 known spyware traces — Pegasus, Predator, Graphite, Candiru. Offline, read-only, $0, 27 languages.

**Run it in 3 moves**  
1️⃣ Grab the double-click app from [releases](https://github.com/interplains/Zero-Breach-Toolkit/releases) — no Python.  
2️⃣ Press **Start check** — Quick 5–10 min, Standard 15–20 min.  
3️⃣ Read the plain-words report, then save it.

| Scan | Time | Reads |
| --- | --- | --- |
| Quick | 5–10 min | browsers |
| Standard | 15–20 min | browsers, apps, startup, file hashes |
| Full | 30 min+ | caches and more file types |

**Three free upgrades after the scan**  
🧾 `--evidence-bundle` packs the report and a SHA-256 manifest into one ZIP — ready for a helpline, lawyer or police.  
🚫 296 spy domains → free [blocklist](https://github.com/interplains/Zero-Breach-Toolkit/tree/main/dist) for Pi-hole, a router or uBlock.  
☎ [Access Now Helpline](https://www.accessnow.org/help/) is free, 24/7, 10 languages — a real human, no account.

* * *

> **🧰 The free after-care kit — 68 tools, every link checked**
>
> #### ⚡ Already inside the download
> 
> - **Evidence bundle** — `--evidence-bundle` → one ZIP: report + JSON + summary + SHA-256 manifest.
> - **Phone capture** — `--collect-android` → pinned [AndroidQF](https://github.com/mvt-project/androidqf), hash-verified.
> - **Practice mode** — `--training spyware|worth-a-look|clean|cellebrite` → a fake phone, zero risk.
> - **Minimal summary** — `--share-json` → share the alarm, not your whole life.
> - **See every check** — `--describe`; read “what could not be checked”.
> - **Blocklists** — [hosts](https://raw.githubusercontent.com/interplains/Zero-Breach-Toolkit/main/dist/adfection.hosts.txt) · [dnsmasq](https://raw.githubusercontent.com/interplains/Zero-Breach-Toolkit/main/dist/adfection.dnsmasq.conf) · [adblock](https://raw.githubusercontent.com/interplains/Zero-Breach-Toolkit/main/dist/adfection.adblock.txt) · [STIX](https://raw.githubusercontent.com/interplains/Zero-Breach-Toolkit/main/dist/adfection.stix.json) · [MISP](https://raw.githubusercontent.com/interplains/Zero-Breach-Toolkit/main/dist/adfection.misp.json).
> - **Verify the scanner** — [VERIFYING.md](https://github.com/interplains/Zero-Breach-Toolkit/blob/main/docs/VERIFYING.md) signed builds + attestations.
> 
> #### 🛡 Second opinions
> 
> - **iMazing Spyware Analyzer** — [imazing.com/spyware-analyzer](https://imazing.com/spyware-analyzer) · free iPhone scan on Amnesty indicators.
> - **MVT** — [mvt.re](https://mvt.re/) · Amnesty’s deep forensic toolkit.
> - **TinyCheck** — [tiny-check.com](https://tiny-check.com/) · watches what the phone sends over Wi-Fi.
> - **AppXpose** — [appxpose.app/spyware-check](https://appxpose.app/spyware-check) · free app + certificate check.
> - **ESET Online Scanner** — [eset.com](https://www.eset.com/us/home/online-scanner) · free full-engine Windows scan + removal.
> - **Kaspersky KVRT** — [kaspersky.com](https://www.kaspersky.com/downloads/free-virus-removal-tool) · free standalone cleaner.
> - **Microsoft Safety Scanner** — [learn.microsoft.com](https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/safety-scanner-download) · free one-shot Windows scan.
> - **SnoopSnitch** — [F-Droid](https://f-droid.org/packages/de.srlabs.snoopsnitch/) · fake towers + patch audit.
> - **chkrootkit** — [chkrootkit.org](https://www.chkrootkit.org/) · Linux rootkit check.
> - **rkhunter** — [rkhunter.sourceforge.net](https://rkhunter.sourceforge.net/) · Linux rootkit hunter.
> 
> #### 🧾 Keep the proof
> 
> - **Apple backup** — [support.apple.com/118426](https://support.apple.com/en-us/118426) · free local backup; encrypt it.
> - **libimobiledevice** — [libimobiledevice.org](https://libimobiledevice.org/) · `idevicebackup2` with no Apple software.
> - **Android bug report** — [developer.android.com](https://developer.android.com/studio/debug/bug-report) · logcat + dumpsys, no root.
> - **ADB** — [developer.android.com/tools/adb](https://developer.android.com/tools/adb) · pull files and logs.
> - **sysdiagnose** — [Apple guide](https://developer.apple.com/feedback-assistant/profiles-and-logs/?name=sysdiagnose) · the iPhone logs.
> - **HashMyFiles** — [nirsoft.net](https://www.nirsoft.net/utils/hash_my_files.html) · hash before and after.
> - **iLEAPP + ALEAPP** — [leapps.org](https://leapps.org/) · parse backups + Android extractions.
> - **Autopsy** — [autopsy.com/download](https://www.autopsy.com/download/) · disk forensics.
> - **Volatility 3** — [github](https://github.com/volatilityfoundation/volatility3) · memory forensics.
> - **EFF guide** — [ssd.eff.org](https://ssd.eff.org/module/mobile-phones-malware) · plain English on the result.
> 
> #### 📡 Watch the network
> 
> - **Pi-hole** — [pi-hole.net](https://pi-hole.net) · per-device DNS log.
> - **NextDNS** — [nextdns.io](https://nextdns.io) · free 300k lookups/month.
> - **RethinkDNS** — [rethinkdns.com](https://rethinkdns.com) · app firewall on Android.
> - **PCAPdroid** — [link](https://emanuele-f.github.io/PCAPdroid/) · phone packet capture.
> - **abuse.ch** — [URLhaus](https://urlhaus.abuse.ch) · [ThreatFox](https://threatfox.abuse.ch) · [MalwareBazaar](https://bazaar.abuse.ch) · live lookup.
> - **Echap indicators** — [github](https://github.com/AssoEchap/stalkerware-indicators) · living list.
> - **MISP** — [misp-project.org](https://www.misp-project.org) · local indicator DB.
> - **Suricata + ET Open** — [suricata.io](https://suricata.io) · [free rules](https://rules.emergingthreats.net/open/).
> - **Zeek** — [zeek.org](https://zeek.org) · per-device connection logs.
> - **Wireshark** — [wireshark.org](https://www.wireshark.org) · read one connection.
> - **DNS leak test** — [browserleaks.com/dns](https://browserleaks.com/dns) · confirm your logger sees the device.
> 
> #### 🚪 Close the door
> 
> - **Lockdown Mode** — [support.apple.com/105120](https://support.apple.com/en-us/105120).
> - **Advanced Data Protection** — [108756](https://support.apple.com/en-us/108756).
> - **Apple threat notifications** — [102174](https://support.apple.com/en-us/102174).
> - **App Privacy Report** — [102188](https://support.apple.com/en-us/102188).
> - **Android Advanced Protection** — [16339980](https://support.google.com/android/answer/16339980).
> - **Privacy Dashboard** — [13530434](https://support.google.com/android/answer/13530434).
> - **Play Protect** — [2812853](https://support.google.com/android/answer/2812853).
> - **GrapheneOS** — [grapheneos.org](https://grapheneos.org/).
> - **Signal** — [signal.org/download](https://signal.org/download/).
> - **Tor Browser** — [torproject.org/download](https://www.torproject.org/download/).
> 
> #### 🆘 Real help
> 
> - **Access Now** — [accessnow.org/help](https://www.accessnow.org/help/).
> - **Digital First Aid Kit** — [digitalfirstaid.org](https://digitalfirstaid.org/topics/surveilled/).
> - **Amnesty Security Lab** — [contact-us](https://securitylab.amnesty.org/contact-us/).
> - **Front Line Defenders** — [emergency contact](https://www.frontlinedefenders.org/en/programme/emergency-contact).
> - **CPJ** — [how to get help](https://cpj.org/emergency-response/how-to-get-help/).
> - **Media Defence** — [case support](https://www.mediadefence.org/apply-for-case-support/).
> - **UN first-hour sheet** — [PDF](https://bangkok.ohchr.org/sites/default/files/documents/2024-06/9.-Where-to-go-for-help.pdf).
> - **FIRST team list** — [first.org](https://www.first.org/members/teams/).
> - **Citizen Lab** — [citizenlab.ca](https://citizenlab.ca/).
> - **Stop Stalkerware** — [stopstalkerware.org](https://www.stopstalkerware.org/).
> 
> #### 🎯 Real-world uses
> 
> - **Used laptop** — [Ventoy](https://www.ventoy.net/en/index.html) · boot, scan, shut down.
> - **After a reset** — [GrapheneOS web install](https://grapheneos.org/install/web) · re-flash a Pixel.
> - **Used iPhone** — [libimobiledevice](https://libimobiledevice.org/) · backup on any PC.
> - **Stalkerware** — [Coalition](https://stopstalkerware.org/stalkerware-detection-removal-and-prevention/) · save the report first.
> - **A parent’s phone** — [DFAK](https://digitalfirstaid.org/topics/device-acting-suspiciously/) · plain-language questions.
> - **Journalist** — [Freedom of the Press](https://freedom.press/digisec/guides/reporting-in-the-field/) · before and after trips.
> - **Newsroom** — [Security in a Box](https://securityinabox.org/en/guide/).
> - **Free check day** — [Data Detox Kit](https://datadetoxkit.org/en/home/).
> - **Before/after reset** — `--json` twice, then diff.
> - **27 languages** — [releases](https://github.com/interplains/Zero-Breach-Toolkit/releases).

* * *

**A clean report is good news, not a guarantee. The free kit is how you make it count.**