interplains/zero-breach
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
Older snapshot: check the original source for current information.
From the publisher
README & documentation
Source previewRead the project’s overview, installation instructions and usage examples. The original README is the source of truth.
[](https://github.com/interplains/zero-breach/actions/workflows/tests.yml) A local, read-only scanner that checks a computer for traces of the AdFection / Candiru spyware campaign — the operation in which an ad-tech company used real-time ad bidding to deliver zero-click spyware to targeted people. Tested on Windows, macOS and Linux (Python 3.8–3.12) in CI. It searches the machine's own leftover records — browser history, cookies, caches and connection records, file fingerprints, auto-start registrations, known malware file-paths and the DNS resolver cache — for published indicators, and reports what it found, how strong the evidence is, and just as importantly what it could not check. In October 2026 The Citizen Lab documented how the ad-tech firm Discover-Tech used its Controlium platform to fingerprint and infect devices the moment an advertisement was rendered, delivering Candiru spyware with no click required. At least 45 devices at Al Jazeera were targeted across 2024–2025. The indicator set here is drawn from that…
Read the full README ↗ · Preview checked 2026-10-29T19:37:19.495Z
Inside the original README — Document outline
- Zero Breach
- Background
- What it checks
- Supported browsers
- Install and run
- Verifying what you downloaded
- Reading the result
- Example: a "nothing found" result
- Indicator data and interoperability
- Updating the indicators
- Design principles
- Tests
Headings are captured from the source. Links open the publisher’s document, not a locally hosted copy.
Documentation belongs to its respective authors. Reported project/model license: Apache-2.0. A listing is not a grant of reuse or training rights. Confirm the document’s own terms at the source.
What this repository does
Zero Breach — local, read-only scanner that checks a computer for indicators of the AdFection / Candiru ad-delivered spyware campaign. No network, no admin, no dependencies.
Repository facts
- Owner
- interplains
- Primary language
- Python
- Stars
- 548
- Forks
- 40
- Open issues + pull requests
- 0
- License
- Apache-2.0
- Archived
- No
- Default branch
- main
- Created
- 2026-10-18T13:22:34.000Z
- Last push
- 2026-10-20T14:26:41.000Z
Topics and intended use
Owner-supplied topics: candiru, digital-security, forensics, incident-response, ioc, misp, spyware, stix, threat-intelligence
Review the README for scope, installation, examples and limitations. We do not run repository code or certify it.
Evaluate before installing
Review licensing and dependencies, inspect recent commits and unresolved issues, and test in an isolated environment before production use. Stars and forks alone cannot answer these questions.
Source and freshness
Source: GitHub. Metadata observed 2026-10-25T12:13:46.029Z. Daily imports are snapshots, not real-time monitoring.
Popularity and source listings do not establish security, suitability, licensing rights or benchmark performance.
Related repositories
EbookFoundation/free-programming-books
donnemartin/system-design-primer