In October 2026 The Citizen Lab documented Israeli spyware being installed through ordinary online advertising — no click required. It was built by Candiru and delivered by an Israeli ad-tech firm, Discover-Tech. The protection researchers recommend is to block ad delivery. This page checks for filtering signals in this browser.
Looking for the Zero Breach app? It checks a computer or phone backup for known spyware. Free for Windows, Mac and Linux: download it with step-by-step instructions. You do not need to run the check below first.
Your results never leave your device. The image checks use this site and its own media host. The DNS check contacts AdGuard’s servers. No advertisements or spyware domains are contacted.
This checks filtering signals, not infection or guaranteed protection. No web page can tell you whether a device has been compromised — if you believe you are a target, use the links at the bottom instead.
Questions about your results? Read the FAQ ↓
test.nextdns.io checks NextDNS, not every filtering service. A browser test only observes that browser; check app or resolver logs for broader coverage.A VPN may override the system DNS. Check its own DNS and filter settings, and inspect resolver logs for the apps you want to cover.
Worth knowing: DNS filtering can reduce exposure to domains on its lists, but it cannot remove ads from Instagram, Facebook, TikTok or YouTube — those come from the same servers as the content itself.
No web page can test this — a page in one browser cannot see your other devices. Two checks that do work:
192.168.1.1 or 192.168.0.1) and look at the DNS
servers. Your provider's default, or a filtering resolver?Running Pi-hole or AdGuard Home already? Its dashboard lists queries per client. If only one client appears, nothing else is using it.
The check above looks for browser filtering signals now. It cannot see whether this computer was reached before — no web page can. Our free tool, Zero Breach, can look: it searches the places this campaign leaves traces on a computer for the indicators documented in published research. It is the deeper check, for anyone comfortable installing one free program first — if that is not you, the protection steps on this page matter more.
You do not need anything technical: download one file, open it and follow the window. It is available in 27 languages.
Your antivirus may flag these programs. Antivirus products often wrongly flag new programs that are not code-signed yet, and some flag these. If you downloaded the file from the links on this page, this is a false alarm and you can ignore it: the code is public, and each program has a public build record you can check. We have applied for free code signing and will report these false alarms to the antivirus companies. If the file came from anywhere else, do not run it and trust the warning.
Windows
zero-breach-toolkit-windows-x64.exe.Mac
zero-breach-toolkit-macos-apple-silicon.dmg for a newer Mac (M1, M2, M3, M4), or zero-breach-toolkit-macos-intel.dmg for an older Intel Mac. The Apple menu → About This Mac says which you have.Linux
zero-breach-toolkit-linux-x64.tar.gz.tar -xzf the file)../zero-breach-toolkit, or right-click it and choose Run in Terminal.Which check? Use Standard unless you have a reason not to: browsers, apps, startup items, program files and out-of-date programs (usually 15 to 20 minutes). Quick looks at browsers only (5 to 10 minutes). Full adds web caches and more file types (30 minutes or more). To check a phone, choose A phone in the window.
A green result is good news, not a guarantee. It means the check found none of the published traces it looks for, in the places it could read. It cannot find spyware nobody has published traces of. If you think you are being targeted, ask a digital-security helpline even if the result is green.
The warnings appear because the programs are not signed by Microsoft or Apple yet; each is built by GitHub from the published source. The checksum at the bottom of this page is for the Python file. Prefer the Python file? The instructions are below.
--update); the checks
themselves never use the internet.python3 -X utf8 zero-breach-toolkit.py (on a Mac, first give Terminal Full Disk Access in System Settings → Privacy & Security, or Safari and some folders cannot be checked). A full check takes about 15 minutes
and shows its progress.Read this before trusting a clean result: it means no known indicators were found where they can be checked — not that the computer is clean. Spyware of this grade is built to defeat exactly this kind of check. If you have a concrete reason to think you were targeted, use the helplines at the bottom of this page.
Official repository: github.com/interplains/Zero-Breach-Toolkit. Release v2.0.4. Check the release checksum ↓
Your VPN may supply its own DNS and override the system setting. Check its DNS and ad-filter settings before adding a DNS profile. If it offers filtering, review that option in the VPN app.
Journalists, human-rights workers and anyone named in this reporting should not rely on self-service tools, this one included. Access Now offers a free helpline for eligible civil-society users. Amnesty and Citizen Lab publish research and resources; these links do not guarantee individual case assistance:
Four steps, in this order. The first can reduce requests to known ad and tracking domains from apps using the system DNS. The second limits what an attack can do if one gets through. The third changes how you were picked in the first place. None of them tells you whether anything already happened — the fourth is for that.
A browser blocker works in one browser. Filtering the system DNS can also reduce ad requests from other apps using that DNS. Apps with their own resolver, a VPN or relay may bypass it. The setup below uses AdGuard DNS's public filtering server: free, no account, ads and trackers blocked by default. Review any existing filter settings before changing them.
dns.adguard-dns.com
94.140.14.14
94.140.15.15
⚠️ If your VPN supplies its own DNS, it may override this setting while connected. Check your VPN’s DNS and ad-filter settings; Mullvad, Proton and IVPN offer filtering options. On iPhone, do this step before Lockdown Mode below, which blocks installing profiles. If iCloud Private Relay is on, Safari may use a different DNS path. Check another browser or your provider’s settings; change Private Relay only if you choose the filtering DNS path.
What this trades and what it misses. Whoever runs the resolver can see the names your device looks up, so this moves that from your internet provider to AdGuard; NextDNS offers the same filtering if you would rather trust it, and Quad9, a Swiss non-profit, blocks malware and phishing but not ads. We have no connection to any of them. It cannot remove ads inside Instagram, Facebook, TikTok or YouTube, which come from the same servers as the content. Hotel and airport wifi sign-in pages sometimes fail with it on — switch it off to sign in, then back on.
Run your own filter? If you use Pi-hole, AdGuard Home, NextDNS, a router or uBlock Origin, you can subscribe to a ready-made blocklist of this campaign's domains — your filter re-fetches it, so it stays current as the list grows:
Lockdown Mode reduces the attack surface available to sophisticated spyware by limiting certain web technologies, apps and device features. Some websites may load more slowly or work differently, and some message attachments and incoming service requests are restricted. It does not guarantee that a particular attack will fail. Update your operating system before enabling it. Apple explains the protections and limits.
Where: iPhone and iPad — Settings → Privacy & Security → Lockdown Mode. Mac — System Settings → Privacy & Security → Lockdown Mode. It restarts the device. Turning it off again is the same two taps.
⚠️ Order matters. Lockdown Mode blocks the installation of configuration profiles — including the DNS profile from step 1. Profiles installed before you switch it on keep working normally. So install your DNS profile first, then turn Lockdown Mode on. Doing it the other way round means switching Lockdown Mode off again to install, which people forget to reverse.
This is why people switch it off: the cost is real and it is paid daily. It is still the recommendation for anyone with reason to think they are a target, and that rests on evidence rather than theory: in April 2023 The Citizen Lab documented Lockdown Mode notifying targets in real time as an Israeli zero-click spyware chain tried to reach them, and found no case of that chain succeeding against a device where it was switched on. They also noted the operator may since have found ways around that notification, so treat it as a measure that raises an attacker's cost, not a guarantee.
Android has no single equivalent switch. The closest set is Private DNS as above, keeping Play Protect on, installing as few apps as possible from as few sources as possible, and — for anyone who genuinely needs it — GrapheneOS on a Pixel.
This one is specific to how this campaign worked. Victims were not found by scanning the internet — they were selected in the ad layer, using the targeting attributes sold in real-time bidding, and the advertising ID is the stable handle that makes one phone addressable across apps. Taking it away breaks the continuity of the profile an operator would have been buying.
What this does not do: it does not make you unfindable. Probabilistic fingerprinting — IP address, device model, operating system version, timing — survives this, so a determined operator can re-acquire a target. It raises their cost rather than removing you from the market. It also does nothing about ads inside Instagram, Facebook, TikTok or YouTube, for the same reason DNS filtering cannot touch them.
These settings do not show whether a phone was compromised in the past. Investigating that requires suitable forensic evidence and specialist interpretation. Depending on the device, that may include a backup or other collected records; missing indicators do not rule out compromise.
Amnesty International's Mobile Verification Toolkit (MVT) is a free, open-source tool for advanced mobile forensic analysis. It requires suitable evidence, a computer and command-line experience. Follow the current installation guide for supported environments and dependencies.
This is a specialist investigation, not a complete infection test. A backup or other collected records may omit relevant evidence; missing indicators do not rule out compromise. Findings need careful interpretation.
If that is out of reach, eligible civil-society users can contact the free Access Now Digital Security Helpline for guidance. Individual forensic assistance depends on the case.
Start here if a result surprised you. Tap a question to open it.
They check different things. This page tests ad filtering in the browser you are using now. It does not search your files or browser history.
The downloadable Zero Breach tool checks saved records and selected files on your computer, and phone backups, for published spyware indicators (Pegasus, Predator, Candiru, AdFection and others). An indicator is a known domain, address or file fingerprint from the research. It is not an antivirus or a general spyware detector.
The number alone cannot tell you that. The scanner counts matching records, so the same indicator can appear more than once, across files or browser profiles. Hundreds of matches do not mean hundreds of infections.
Read the report’s summary, evidence type and indicator’s role. A name in a saved article is different from a connection record, and both are different from finding a known spyware file. A large number of weak matches does not turn them into proof of infection.
Blocking ads now does not erase older records. The scanner can also find records from other installed browsers and profiles, not just the browser you use today.
A cached research article or blocklist can contain the names being searched for. Those text-only findings are labelled referenced; they do not establish contact with those addresses.
Check each finding’s date, if recorded, browser/profile and evidence type. Matches alone do not prove that your blocker failed. Keep it enabled while you review the report.
A missing or unrecognised evidence label needs review; do not treat it as harmless.
Save the report and follow its summary. Check the evidence type, indicator’s role, date and location. Do not open flagged addresses or delete files just to make the result disappear. Keep the original records while you investigate.
For advertising-network traces or saved references, start with that context. If you cannot explain the finding, ask trusted IT support to help interpret it.
A known spyware-file match, persistence finding, or connection record for spyware control infrastructure needs prompt specialist review. A credible targeting concern or genuine security notification also warrants help, whatever the scan says. Contact your organisation’s security team or a qualified incident responder. Eligible civil-society users can contact the Access Now Digital Security Helpline.
It means no listed indicators were found in the places the tool could check. It does not rule out an infection. Records may have been cleared, some checks may not have run, and other spyware or different versions may leave different traces.
Read the report’s coverage gaps. File fingerprints only match known samples, and the tool does not inspect running memory.
Read the result’s label. “Ad hiding is working” means this browser hid the test ad elements. It does not mean that all ad requests were blocked or that your device was checked for infection.
“Not verified” means the page could not confirm that check. It does not automatically mean your filter is off. This page checks for AdGuard DNS; it does not identify every DNS provider. Keep an existing filter enabled and check its settings or its own test page. A VPN or Private Relay can change which DNS this browser uses.
The recovered spyware sample in this AdFection investigation targets Windows. The published investigation does not establish Linux or Mac infections in this campaign. That does not make either platform immune to spyware.
Zero Breach runs on Linux and Mac to check supported browser records (including Safari) and files. This is not a claim that it detects a Linux or Mac spyware implant. Windows-only checks are reported as not run.
You can use this page to check the phone’s browser filtering. Open it in your usual browser, rather than Instagram’s or another app’s built-in browser.
Yes, with Zero Breach on a computer. It checks a local iPhone backup, or an Android collection made with AndroidQF, for published Pegasus, Predator and other spyware indicators; the guide shows each step. A phone backup does not contain everything a specialist lab can examine, so if you think you are being targeted, also see the mobile investigation guidance.
Your results are not uploaded automatically. Both the browser check and the downloaded scanner keep results on your device. The browser tests request images from this site and its media host, and contact AdGuard for the DNS check. The scanner does not visit the indicator addresses.
Do not post the full report publicly. It can include usernames, browser profile names, file paths and browsing details. For an initial question, share only the relevant summary and evidence labels after removing personal details. Keep the original unchanged, and ask a trusted responder how to send it securely if needed.
Published by ArchiveGenocide.
Canonical page: https://archivegenocide.com/scan/
Official repository: github.com/interplains/Zero-Breach-Toolkit
Release: v2.0.4 · File: zero-breach-toolkit.py
Expected SHA-256
98279a7212220260f78e72020e52420565cc6c0c00f25bb02d478902288b80fc
Compare SHA-256, or verify the GPG signature below before running the file. A checksum match alone does not authenticate the publisher.
Signed with ArchiveGenocide’s published release key.
Full GPG fingerprint:
C24EC92B12D6670A2516065F9B4D575499AFA53C
Detached scanner signature ·
Checksum manifest
(manifest signature)
Public signing key
(release copy) ·
ArchiveGenocide’s established verification page
Open a terminal in the folder containing the downloaded zero-breach-toolkit.py.
Windows PowerShell: Get-FileHash zero-breach-toolkit.py -Algorithm SHA256
macOS: shasum -a 256 zero-breach-toolkit.py
Linux: sha256sum zero-breach-toolkit.py
Compare all 64 characters; letter case does not matter. If they differ, do not run that file. Return to the official v2.0.4 release and download it again.
With GPG installed, download zero-breach-toolkit.py, its detached signature,
and the public key’s release copy above into the same folder. Open a terminal there.
gpg --import archivegenocide-signing-key.asc
gpg --fingerprint C24EC92B12D6670A2516065F9B4D575499AFA53C
gpg --verify zero-breach-toolkit.py.asc zero-breach-toolkit.py
Before trusting the key, compare its full fingerprint with this page and the official ArchiveGenocide verification page. The signature must verify using that key. If the fingerprint differs or verification fails, do not run the file.