interplains/zero-breach is a scanning tool that finds traces of AdFection and Candiru, ad-delivered spyware campaigns, on a target device. Instead of modifying files it only inspects them read-only, it does not access the network, and it requires neither administrator privileges nor external dependencies. The latest release is v0.1.7.
Its scan targets are browser history and cache, file fingerprints (identifying values of a file), autostart entries, DNS records, and Windows host traces. Every trace it finds is tagged with a confidence level, and the areas it could not verify are kept in the results as well. The confidence level indicates how strong the evidence for that trace is.
What stands out is that the characteristics of the targeted attack itself were turned into the detection rules. Instead of sweeping across several kinds of spyware, it targets only the indicators of a specific campaign. The implementation language is Python, the license is Apache-2.0, and the star count is 470.
That said, the repository warns on its own that a clean result does not guarantee the safety of the device and does not replace expert help. The default scan uses only the standard library, while the optional file pattern scan requires a separate engine. No figures are given for detection rate or false positives. What changed in v0.1.7 is not confirmed. So this tool is closer to a first-pass check that sweeps for traces of a specific campaign, and it cannot replace a general security scanning tool.