One tweet plus a line asking for a star: Zero Breach Toolkit, a spyware self-check tool, gained 4,469 stars in 12 days

Zero Breach Toolkit is a free, read-only, offline spyware self-check tool that looks for traces of commercial spyware like Pegasus, Predator, and Candiru on computers, Android phones, and iPhone backups. Its detection itself has nothing new: it uses publicly available signatures from research organizations. Most of its stars also didn't come from developers: the author runs a pro-Palestinian X account with 395k followers, posted about it after an Israeli spyware scandal made the news, and ended the post with "If this tool helped you, please give us a star on GitHub." Below is how it grew, what you can learn from it, and why following it isn't worth much.

A tweet with a video

On Oct 27 2026 at 19:18 UTC, the X account @xIsraelExposedx (Israel Exposed, about 395k followers, xbeast.io) posted a tweet with a video:

"We've released Zero Breach Toolkit, a free, open-source tool that detects traces of over 12,100 Israeli and other spyware on your device. Works on Windows, Linux, Mac, Android, and iPhone... It never writes to disk, never connects to the internet, and requires no admin rights. A run takes 10 to 15 minutes... If you find spyware on your device, send it to us via Telegram. If this tool helped you, please give us a star on GitHub."

The next day, the security firm Beam wrote that the post had passed 500k views in a single day. One of the most-liked replies read: "Didn't expect to be living through a time of global war, psychological war, and code war all at once. Thanks for the digital garlic."

Behind the account is archivegenocide.com, which says it has archived over 156k videos and photos related to Gaza. The GitHub account interplains uses the display name ArchiveGenocide, with the bio "We archive and expose Israel's war crimes." The tool wasn't made by a security company but by a political archive project.

Why October, specifically

12 days earlier, on Oct 15, the University of Toronto's Citizen Lab published a report called "Exposing AdFection": the Israeli adtech company Discover-Tech used ordinary real-time bidding ads to deliver Candiru's zero-click spyware to targets, and at least 45 Al Jazeera devices were infected. It was the first public evidence that spyware could be delivered through targeted ads. The Guardian, Wired, the FT, Al Jazeera, and Anadolu all covered it.

With that much coverage, readers naturally asked, "Was I infected too?" Three days later (10-18), the same X account released its first tool, zero-breach. It only scanned Windows computers, only checked the 338 signatures from the AdFection incident, and required installing Python first and then typing commands into PowerShell. The repo stalled at about 550 stars.

A week later, they expanded it into Zero Breach Toolkit: detection went from one incident to well-known spyware like Pegasus, Predator, and Graphite, adding Android and iPhone support. The tweet included a video and that line asking for a star.

How the stars climbed

(GitHub daily star count, recorded once per day by Beijing time.)

This is a typical single pulse: it peaked the day after the post and then roughly halved each day. On the same day, the older repo zero-breach also gained 163 and 178 stars, and the two repos rose together, showing the traffic came from the same source.

After the tweet, pro-Palestinian communities copied the original text across platforms: several Instagram reels, TikTok, YouTube Shorts, the Safa News and ArchiveWarCrimes Facebook pages, Reddit's r/Palestine, and LinkedIn. X itself mentioned "a free tool called Zero Breach" in its trending summaries. On the tech side, almost nothing: Hacker News had one post with 2 points, no mainstream tech media covered it, and it never made GitHub trending.

There are 473 forks, 10.6% of the stars, far above the norm for a library. My inference: many people weren't "bookmarking a project" but clicked the green Code button to download it following a tutorial.

What it actually is

Open the README and the first paragraph isn't about technology but three promises: read-only, changes nothing on your system; no internet during scans, nothing uploaded; clearly states its limits, with a green result meaning "good news, not a guarantee." Right after is a bolded line: if you think you're being targeted right now, consult an expert first and don't run this tool, followed by links to the Access Now helpline and Amnesty International's Security Lab.

Below are steps written for people who don't understand technology at all, down to "click the yellow Download Python button" and "check Add python.exe to PATH on the first installer screen." Starting with v2, you don't even need Python: download one file, double-click, choose "standard check," press "start," and after 15 to 20 minutes it tells you in plain language what it found and what to do next. The README also warns in advance that your antivirus may flag it because the program isn't signed. If you downloaded it from the official release page, that's a false positive; if you got it from elsewhere, don't run it.

The detection logic is simple: it takes indicators published by Amnesty International, MVT, Echap, and Citizen Lab and compares them against browser history, cookies, DNS cache, startup items, and file fingerprints. Phones are scanned using androidqf from the MVT team. Each match is graded: the file is actually on the disk, it has connected to a suspicious address, or the address is only mentioned on a web page.

The tweet's claims are more dramatic than the README. Beam's conclusion after reading the code: the "12,100 traces" can't be verified, the bundled library has about 658 of them, and the rest are downloaded at update time. "Never writes to disk" and "never connects to the internet" only hold for the scanning step. Beam also said these discrepancies are spelled out in the README: "the project is more careful than the tweet. Trust the docs, not the headline."

Who it's competing with

Among open-source peers, MVT built up 15.8k stars over five years; the rest have only a few hundred each. Zero Breach occupies a gap MVT doesn't cover: built for regular people, scanning computers and phones together, multilingual, and runnable with a double-click.

There are copycats too: a Rust port, several "enhanced", "GUI" and "deployment guide" versions, each with only 0 to 3 stars. An unofficial website, zerobreachtoolkit.com, is also grabbing search traffic.

Why this one got the stars

The most convincing evidence is its own control. Same account, same followers, same news story, pushed twice:

• 10-18 promoted zero-breach: Windows only, one incident only, needed command-line use, no star ask in the tweet, stalled around 550 stars;
• 10-27 promoted Zero Breach Toolkit: every device covered, named familiar names like Pegasus, paired with a video, ending with "leave us a star on GitHub". 12 days, 4,469 stars.

So distribution is the gate. Without a 395k-follower account, neither push took off (sentinel, a near-identical cross-platform detector from the same period, only reached 181 stars). But with the same distribution, "broad coverage, usable by ordinary people, and an explicit star ask" amplified the result eightfold.

There's also an identity layer: for journalists, activists, and pro-Palestinian communities, this reads as "our own people built a tool against Israeli spyware." That makes people want to share it, and it got many non-coders to visit GitHub and star it for the first time. The same identity layer also brings suspicion: a poster on r/cybersecurity called it "suspicious, riding the news headline," and on X someone asked "is it safe to download?" The security community is watching and nobody is vouching for it.

If it were you

One judgment: "After a major security incident, build a 'did I get hit?' self-check tool that ordinary people can use within a week" is a playbook you can learn. But this project's stars came from its author's 395k-follower political account and a community mobilized around it, and that part can't be copied. Building another spyware detector from scratch would land between MVT and this tool and get only a handful of stars. There's something to learn here, but chasing this one specifically isn't worth it.

Who it suits: people who already have a community or tens of thousands of followers in some circle (journalists, lawyers, domestic violence support, crypto holders, diaspora communities of some country) and can write a bit of code. Or people close to security research institutes or NGOs who get early access to newly disclosed indicators.

Who it doesn't suit: solo indie devs with no distribution channel who hope to win stars with "yet another spyware scanner." Sentinel's 181 stars are the reference point. It's also not for people unwilling to take on trust risk: unsigned executables get flagged by antivirus software, and if the tool is considered a honeypot or malware, the reputation damage runs the other way.

How to do it:

• Don't build "another Zero Breach." Apply the same approach to a different scenario. The nearest open slot is tracking software and locators: stalkerware apps installed on a partner's phone, AirTags hidden in bags, locations shared without consent. The audience is much larger than spyware's, while existing tools like ISDi and spytrap-adb only have one or two hundred stars and require adb commands (inferred). Another direction is browser extension self-checks: every time news breaks that an extension was acquired and then shipped malicious code, people ask "is the one I installed affected?"
• Localize it for different languages and audiences: ordinary users in Chinese, Spanish, and Arabic have no self-check tool with click-by-click instructions written in their native language. Zero Breach's program UI supports 27 languages, but the step-by-step guide on the GitHub homepage is in English, so Chinese users have to translate it themselves (inferred).
• Copy its README: open with three promises (read-only, no network calls, limitations stated), then "if you really feel you're being targeted, consult an expert first," then a button-level tutorial step by step. Each report should clearly state what wasn't checked. Beam gave it positive reviews specifically for this.
• Copy its cadence: first catch the news with a single-purpose tool (v1), expand to broader coverage a week later (v2), then ship a double-click-to-run version (v3). Each release is a new reason to post.
• Fix its weak spot: do code signing from the start and spell out how to verify the release page. This is where it got the most criticism.

How to get users: the launch has to go out on your own community accounts, with a demo video and an explicit ending like "if this helped you, please star it on GitHub." Comparing the two tweets, that line is worth writing. Then reach the people covering the incident: the journalists reporting on it, NGOs running digital security training, tech bloggers in each language, and give them something they can share directly. On tech forums like Hacker News and r/netsec, rather than begging for attention, first invite a public audit and let a third party's conclusions do the talking.

When to move: the window for this play is one to two weeks after an incident is reported. If you miss AdFection, that's fine. The next time Citizen Lab, Amnesty International, or Google's threat intelligence team publicly exposes a major case, have the framework ready so you can ship within days of the indicators being published.

Signs you're reading it wrong: ① Two or three weeks out, a comparable self-check tool without a big account behind it (like sentinel) grows to a thousand-plus stars on its own. That means demand for "ordinary people's security self-check" is big enough that distribution matters less, which makes it worth pursuing. ② Zero Breach keeps gaining dozens of stars a day steadily with no new tweets, meaning the security community has accepted it as the popular version of MVT and that spot is taken, making a follow-up harder. ③ Apple, Google, or Microsoft builds spyware trace checks into the OS (Apple is already sending threat notifications to targeted people), which weakens the case for third-party tools in this category.

Data and sources

GitHub repo page, README, and daily star records (10-28 through 11-06); two tweets from X @xIsraelExposedx 10-18 and 10-27; follower count on xbeast.io; Citizen Lab's "Exposing AdFection" (10-15) and coverage by The Guardian, Wired, FT, and Al Jazeera; Beam's audit article (agentbeam.com) 10-28; reposts on Instagram, TikTok, Facebook, and Reddit r/Palestine; competitor star counts as of 11-06, with "about" meaning rounded. The view count for the tweet comes only from Beam's claim; the play counts of the cross-platform reposts and the release download counts are unverified.