interplains/zero-breach

选用指南

AI 根据 README 整理 · 2026/10/19 06:56:23

适用场景

当用户怀疑设备可能受到 AdFection / Candiru 间谍软件活动影响时，可使用此工具进行本地自查，检查浏览器记录、文件指纹和系统配置等痕迹。

查看 README 依据

# Zero Breach [](https://github.com/interplains/zero-breach/actions/workflows/tests.yml) A local, read-only scanner that checks a computer for traces of the **AdFection / Candiru** spyware campaign — the operation in which an ad-tech company used real-time ad bidding to deliver zero-click spyware to targeted people. Tested on Windows, macOS and Linux (Python 3.8–3.12) in CI. It searches the machine's own leftover records — browser history, cookies, caches

and connection records, file fingerprints, auto-start registrations, known malware file-paths and the DNS resolver cache — for published indicators, and reports what it found, how strong the evidence is, and just as importantly **what it could not check**. > **A clean result is not a clean bill of health.** Spyware of this grade is built > to defeat exactly this kind of check, most of the evidence it leaves expires > within weeks, and Windows does not record DNS history unless someone turned it > on. This tool narrows uncertainty; it does not remove it. If you have real

目标用户

面向怀疑自己可能成为间谍软件目标的个人用户，以及需要初步排查的安全研究人员。

查看 README 依据

and connection records, file fingerprints, auto-start registrations, known malware file-paths and the DNS resolver cache — for published indicators, and reports what it found, how strong the evidence is, and just as importantly **what it could not check**. > **A clean result is not a clean bill of health.** Spyware of this grade is built > to defeat exactly this kind of check, most of the evidence it leaves expires > within weeks, and Windows does not record DNS history unless someone turned it > on. This tool narrows uncertainty; it does not remove it. If you have real

> reason to believe you are a target, the right step is expert help — the > [Access Now Digital Security Helpline](https://www.accessnow.org/help/) or the > [Amnesty International Security Lab](https://securitylab.amnesty.org/) — not a > self-service script. ## Background In October 2026 The Citizen Lab documented how the ad-tech firm Discover-Tech used its **Controlium** platform to fingerprint and infect devices the moment an advertisement was rendered, delivering Candiru spyware with no click required. At least 45 devices at Al Jazeera were targeted across 2024–2025. The indicator

使用方式

通过命令行运行，支持完整扫描和快速扫描（跳过文件指纹），并可输出 JSON 格式报告。

查看 README 依据

or Linux use `python3` in place of `python` in the commands below. ``` python -X utf8 zero-breach.py # full scan python -X utf8 zero-breach.py --quick # faster; skips file fingerprinting python -X utf8 zero-breach.py --json report.json ``` **From source:** ``` python -X utf8 scan/adint-scan.py ``` The scan changes no system settings and needs no administrator. It makes no intentional network requests or indicator lookups. Remote and redirected paths are skipped, and online certificate verification is disabled. Locked database

部署要求

需要 Python 3.8 或更高版本，无需管理员权限，无第三方依赖。

查看 README 依据

article about the campaign. The tool distinguishes saved references from connection evidence so that each finding can be interpreted in context. ## Install and run Requires Python 3.8 or newer. No administrator. No third-party packages. **Single file (simplest):** [download zero-breach.py](https://github.com/interplains/zero-breach/releases/latest/download/zero-breach.py), verify it using the [release checksums](https://github.com/interplains/zero-breach/releases/latest), then open a terminal in the download folder. On Windows use `python`; on macOS

已知限制

作者明确说明，扫描结果干净并不代表设备绝对安全，间谍软件可能绕过此类检查，且部分证据（如 DNS 历史）在 Windows 上默认不记录。

查看 README 依据

and connection records, file fingerprints, auto-start registrations, known malware file-paths and the DNS resolver cache — for published indicators, and reports what it found, how strong the evidence is, and just as importantly **what it could not check**. > **A clean result is not a clean bill of health.** Spyware of this grade is built > to defeat exactly this kind of check, most of the evidence it leaves expires > within weeks, and Windows does not record DNS history unless someone turned it > on. This tool narrows uncertainty; it does not remove it. If you have real