中文版

Zero-Breach-Toolkit（GitHub：https://github.com/interplains/Zero-Breach-Toolkit ，2026-10-25 创建，今晨抓取时已 4,518★）是免费开源的雇佣间谍软件痕迹检测工具：查电脑、安卓手机与 iPhone 备份里有没有 Pegasus、Predator、Graphite、Candiru 等已知商业间谍软件留下的痕迹。2.0 版已是 Windows、Mac、Linux 三平台的双击即用程序，界面支持 27 种语言，不需要懂技术。

它只读不写：不改原始证据、不改系统设置，只写临时数据库快照和你要求保存的报告；扫描全程不联网，从不上传任何东西。标准检查覆盖浏览器、应用、开机启动项、程序文件与过期软件，一般 15~20 分钟；快速检查只看浏览器（5~10 分钟），完整检查再加网页缓存与更多文件类型。手机通过连电脑检查，界面里有分步指引。

作者在报告里说得很清楚：干净结果是好消息，不是保证——它只能发现已公开的痕迹，找不到没人公开过的间谍软件，也证明不了设备绝对安全；怀疑自己正被针对时应先找专业人士求助。另注意：程序尚未获得微软/苹果的代码签名，杀毒软件可能误报，从官方 Release 页下载的可按指引验证构建证明（gh attestation verify）后忽略；从别处来的文件不要运行。

为什么值得了解

• 对记者、活动人士或任何担心设备被针对的人，这是把原本要专家动手做的取证检查，变成了双击 20 分钟的自助工具
• 设计态度值得学：只读、断网扫描、每份报告都写明证据强度与查不到的部分，干净结果从不包装成“绝对安全”
• 但它查的是“已知痕迹”，不是全盘杀毒；也别指望它替代专业求助渠道，README 里直接给了 Access Now 与 Amnesty 安全实验室的求助入口

English Version

Zero-Breach-Toolkit (GitHub: https://github.com/interplains/Zero-Breach-Toolkit , created 2026-10-25, 4,518 stars at this morning’s fetch) is a free, open-source check for traces of known mercenary spyware — Pegasus, Predator, Graphite, Candiru and others — on computers, Android phones and iPhone backups. Version 2 is a double-click app for Windows, Mac and Linux, in 27 languages, no technical knowledge needed.

It is read-only: it never modifies source evidence or system settings, writing only temporary database snapshots and the reports you ask for; and it makes no network requests during a scan, with nothing uploaded. The Standard check covers browsers, apps, startup items, program files and out-of-date programs, usually in 15 to 20 minutes; Quick looks at browsers only (5 to 10 minutes), and Full adds web caches and more file types. Phones are checked by connecting them to the computer, with step-by-step guides in the app.

The author is explicit in the reports: a clean result is good news, not a guarantee — it can only find published traces, cannot find spyware nobody has published traces of, and does not prove a device is safe; anyone who thinks they are being targeted should get expert help first. One more note: the programs are not yet code-signed by Microsoft or Apple, so antivirus products may flag them; files from the official release page can be verified against their public build attestation (gh attestation verify) and the warning ignored — but a file from anywhere else should not be run.

Why it’s worth knowing

• For journalists, activists, or anyone worried their device is targeted, this turns a forensic check that used to need an expert into a 20-minute self-service tool
• The design attitude is worth studying: read-only, offline scanning, and every report states the strength of the evidence and what could not be checked — a clean result is never dressed up as “absolutely safe”
• It checks for known traces, though, not as a general antivirus; and it is no substitute for professional help — the README links straight to the Access Now helpline and Amnesty International’s Security Lab