interplains / zero-breach

# Zero Breach
> Release v0.1.8 corrects the version the download reports (v0.1.7 shipped
> reporting itself as 0.1.6) and refuses network paths given to `--iocs`/`--json`
> in the single-file build. Optional Candiru patterns still need the pinned YARA-X engine;
> see pattern validation. Default checks remain standard-library-only.
A local, read-only scanner that checks a computer for traces of the **AdFection /
Candiru** spyware campaign — the operation in which an ad-tech company used
real-time ad bidding to deliver zero-click spyware to targeted people. Tested on
Windows, macOS and Linux (Python 3.8–3.12) in CI.
It searches the machine's own leftover records — browser history, cookies, caches
and connection records, file fingerprints, auto-start registrations, known
malware file-paths and the DNS resolver cache — for published indicators, and
reports what it found, how strong the evidence is, and just as importantly
**what it could not check**.
> **A clean result is not a clean bill of health.** Spyware of this grade is built
> to defeat exactly this kind of check, most of the evidence it leaves expires
> within weeks, and Windows does not record DNS history unless someone turned it
> on. This tool narrows uncertainty; it does not remove it. If you have real
> reason to believe you are a target, the right step is expert help — the
> Access Now Digital Security Helpline or the
> Amnesty International Security Lab — not a
> self-service script.
## Background
In October 2026 The Citizen Lab documented how the ad-tech firm Discover-Tech used
its **Controlium** platform to fingerprint and infect devices the moment an
advertisement was rendered, delivering Candiru spyware with no click required.
At least 45 devices at Al Jazeera were targeted across 2024–2025. The indicator
set here is drawn from that reporting and from Recorded Future's independent
tracking of the same infrastructure.
The delivery vector abuses real-time ad bidding. Keep operating systems and
browsers updated, reduce exposure with ad filtering, and investigate surviving
traces where appropriate. This tool checks those traces; it does not replace
updates or establish that a device is safe.
- The Citizen Lab, *Exposing AdFection* (2026-10-15)
- Recorded Future / Insikt Group, *Tracking Candiru's DevilsTongue Spyware* (CTA-2025-0805)
## What it checks
| area | what it reads |
|---|---|
| **Browser** | history, cookies (host names and timestamps only), favicons, HTTP cache, Local/Session Storage, Service Worker caches, and HSTS/connection records — across Chrome, Edge, Brave, Vivaldi, Chromium and Firefox, for discovered profiles in supported locations |
| **Files** | SHA-256 of candidate files under the user-writable locations spyware drops into, against known sample hashes — and, kept deliberately separate, the hash of a legitimate signed driver this actor abuses, which is reported as a lead rather than as proof |
| **Host** (Windows) | per-user COM registrations (this campaign's docu