Tool Open source
Zero Breach is a local, read-only Python scanner for traces of the AdFection and Candiru ad-delivered spyware campaigns. It examines browser histories, cookies as host names and timestamps, caches, connection records, file fingerprints, per-user Windows COM registrations, known file paths, hosts-file entries, and DNS resolver data against published indicators, then grades findings as on-disk, persistence, contacted, DNS-record, configured, or referenced evidence. It can export indicator data and findings for STIX, MISP, and DNS or ad-blocking formats. Default checks use only the Python standard library, make no intentional network requests, require no administrator access, and run on Windows, macOS, and Linux; optional Candiru file-pattern checks require the pinned YARA-X engine. The project emphasizes that a clean result is not proof that a device is safe, because unsupported locations, unrecorded DNS activity, expired traces, and spyware designed to evade such checks remain outside its coverage. The scanner is licensed under Apache License 2.0, while its indicator data is released under CC0 1.0.
1 use taken from transcripts — each links to the moment in the video.
Read-only Python scanner that checks a computer offline for traces of the adfection and Canderoo spyware campaigns against 338 published indicators, grading matches by strength and exporting them as STIX, MISP feeds, or DNS block lists.
1 in the library.