A free scanner hunts Pegasus traces on phones and laptops
Mercenary spyware is sold to governments as lawful interception and lands on journalists and dissidents, and it works because the target cannot inspect the device. Version 2.0.0 of the Zero Breach Toolkit, published on November 1, 2026, turns that check into a double-click program in 27 languages, and the report it prints names what it could not read.
The Zero Breach Toolkit published version 2.0.0 at 2:09 p.m. Washington time on November 1, 2026, turning a Python script into a program that opens with a double click on Windows, Mac and Linux and runs in 27 languages. The second release followed 27 minutes later, at 2:36 p.m. Washington time, to repair a defect in the new build: the 2.0.0 programs could not open an encrypted iPhone backup and could then report that no spyware traces had been found. The release note asks anyone who checked an encrypted backup with 2.0.0 to run the check again.
The program hunts published traces of Pegasus, Predator, Graphite and Candiru in the records a machine keeps. On a computer it reads browser history, cookies, connection records, bookmarks, downloads and saved caches, and on Windows the Run box, Defender history, PowerShell logs, Prefetch and Amcache entries. On phones it reads an Android collection taken with AndroidQF or a local iPhone backup. Each match carries a grade for the strength of the evidence, and every report ends with the checks that could not run. The documentation is careful about what leaves the machine: the scan makes no network request, and the indicator lists are fetched in a separate step the user starts. A standard computer check takes about 15 minutes.
The limits are printed by the project itself, and they decide what a result means. The tool finds indicators that researchers have already published, so spyware written for a single target does not appear in it. The documentation adds that implants are often rebuilt for each target and that many traces expire within weeks, and that a computer check cannot say whether a phone is infected. A quiet run lists the places that were not read, which is a different answer from a clean one, and the project states that “a clean result is never presented as proof that you are safe.” The three principles on its own site are read-only access, a scan that stays offline and limits declared in every report.
The market the scanner is aimed at
Commercial spyware became an industry by selling governments what vendors call lawful interception. The International Federation of Journalists mapped the market in a report published in March 2026 and recorded that Pegasus, made by the Israeli company NSO Group, had been found on the devices of at least 180 journalists selected for targeting in the 2021 Pegasus Project disclosures, while Intellexa’s Predator and Paragon’s Graphite widened the supply. The purchases are legal where they are made and invisible to the people they reach, and the consequence is the asymmetry a scanner of this kind attacks: the records a laboratory would examine stay on the target’s own disk, unread by the person who owns them.
The forensic method has a lineage. Amnesty International’s Security Lab published in 2021 the procedure for finding Pegasus in the records a phone keeps, and the Mobile Verification Toolkit released with it became the reference examiners apply to phone backups. What changed is the price and the address. A check that once required a laboratory, a lawyer and a flight now runs on the suspected machine itself — with nothing sent anywhere.
Why browser records became evidence
On October 15, 2026, the Citizen Lab published the first public confirmation of zero-click mercenary spyware delivered through targeted advertising, a technique it named AdFection. An Israeli company called Discover-Tech bought ad impressions through ordinary programmatic channels and used a platform named Controlium to fingerprint devices and redirect them to infection at the moment an advertisement rendered. The campaign was used to target at least 45 Al Jazeera devices with Candiru’s spyware in 2024 and 2025, according to the Citizen Lab report, a finding the Committee to Protect Journalists relayed on the day of publication. The detail that matters for a scanner is banal: an attack that travels through ad auctions leaves redirects, domains and connection records in the browser, which is the material the toolkit compares against its lists.
The scanner returns to the target the first look at their own machine, and with it the duty to say what that look does not cover.
A week of users, and one false clean
The repository, which credits an account called ArchiveGenocide as its maker, opened on October 25, 2026 and had 4,097 stars, 432 forks and seven open issues by the afternoon of November 1, 2026, a volume of scrutiny that few projects of that age attract. The release notes read like a list of the mistakes a crowd finds. Version 0.1.15, on October 31, stopped ad blockers from producing false matches, because uBlock Origin, AdGuard and EasyList keep copies of the advertising domains in the browser cache, and the scanner was reading the blocklists as if they were evidence. Earlier builds fixed false positives on Pixel phones and an error in Windows Android collection. Version 2.0.0 credits an outside contributor for a practice mode that teaches people to read a result, and another for an Android fix that had mistaken application names declared in an app’s queries list for installed apps.
Independent readings measured the tool instead of repeating its announcement. AgentBeam cloned version 0.1.7 on October 28, 2026 and counted about 658 indicator lines in the repository, against the “over 12,100 traces” of the project’s own post, and noted that the project’s own privacy note contradicts the promise that the tool never writes to disk. RepoSquare published on October 29, 2026 a hands-on test with three synthetic browser profiles: the planted indicator was found, a lookalike domain was ignored, and the silent runs exited with code 3, which marks a check that could not run, so the tool never returned the code that would mean no match and no gap.
Coverage is the other half of the argument. RepoSquare counted 405 ad-infrastructure lines and 23 mercenary-spyware lines in the copy that ships for offline use, and 13,131 indicators after the update command pulled 29 lists from their publishers. The project’s own documentation states that its coverage table is not a measure of real-world detection or of false-positive rates, and AgentBeam reported no independent numbers either.
The trust the program asks for
Running it still requires trusting a stranger’s code with browser history and a phone backup. The binaries carry no signature from Microsoft or Apple, so both systems warn on first launch. Each program is built by GitHub from the published source, with a public build attestation, and the releases are signed with a public key that the documentation lists, alongside the commands to verify both the build attestation and the signature before running. There is no independent security audit, the author is anonymous, and the project says the Windows executable has no code signature because signing requires a legal identity. For anyone with a concrete reason to think a device is compromised, the reports point to the Access Now Digital Security Helpline, which is free and answers around the clock.
The toolkit shortens one distance, the one between the examiner and the person examined. The distance between the vendor and the government that buys its product stays where it was, and so do the lists, which researchers write after the campaigns they describe. The Al Jazeera devices were reached by ads bought by a company that sold itself to the advertising market as legitimate; the agencies that buy Pegasus, Predator and Graphite answer to their own governments alone; and the indicators the scanner reads arrive after the fact. The question the week leaves open is who answers for the spyware that no list carries yet, because the program can tell a person what researchers have already found on their device, and it has nothing to say about what was never published.