# Spyware check: licence and file provenance

GENERATED by build-spyware.js from spyware/sources.json. Do not edit by hand.

Reviewed 2026-10-28. Licences were read at the pinned commit, not at the current repository state. This is an engineering inventory, not legal advice.

## Rule applied

A list is included only when the organisation that licenses it also produced the indicators in it (its own research), under a licence that allows reuse on this site. A list compiled from other organisations' reports, or mixing in indicators first published by others, is excluded until its reuse basis is documented: the compiler's or publisher's licence declaration alone is not treated as sufficient. Excluded files are not shipped.

## Code

- Zero Breach Toolkit (https://github.com/interplains/Zero-Breach-Toolkit, commit 951efef), Apache License 2.0: `spyware-iocs.js` and `spyware-android.js` port parts of `scan/zbtriage/feeds.py`, `stix.py`, `iocs.py` and `modules/android.py` (pin list, STIX pattern rules, value validation, shared-service list, a subset of the Android checks), rewritten in JavaScript with changes. Distributed here under AGPL-3.0-only, which is compatible with Apache-2.0. No indicator data from that project is used.

## Repositories

| Repository | Pinned commit (date) | Licence at that commit |
|---|---|---|
| [AmnestyTech/investigations](https://github.com/AmnestyTech/investigations) | `3d8f248a0d015f183724ae7d096a5c46a8bb5fc7` (2024-12-16) | [CC BY 2.0](https://creativecommons.org/licenses/by/2.0/) — README: 'shared under the license CC-BY'. Attribution to Amnesty International required. |
| [AssoEchap/stalkerware-indicators](https://github.com/AssoEchap/stalkerware-indicators) | `426156175adc84af7fbdd41486c046f9ecb40436` (2026-10-20) | [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/) — README 'License' section. Attribution to Echap required. |
| [citizenlab/malware-indicators](https://github.com/citizenlab/malware-indicators) | `7a7ae9278fa2c0252e9e40faed9b498d6a8d5248` (2020-06-09) | [CC BY-NC-SA 4.0](https://creativecommons.org/licenses/by-nc-sa/4.0/) — NonCommercial: this site carries ads and accepts donations. Excluded until the Citizen Lab gives permission (same reasoning as the Phishing Army decision, 26 Oct). |
| [mvt-project/mvt-indicators](https://github.com/mvt-project/mvt-indicators) | `b22ddf05e1a31e7732b8895676987c5c3482ef65` (2026-08-27) | [MIT](https://github.com/mvt-project/mvt-indicators/blob/b22ddf05e1a31e7732b8895676987c5c3482ef65/LICENSE) — Repository licence (MIT, 'Copyright (c) 2022 MVT'). The bundles collect indicators from published research by others; MIT is the terms under which the MVT project redistributes them. |

## Files

| File | Upstream path | SHA-256 | Origin | Status | Basis |
|---|---|---|---|---|---|
| amnesty-pegasus-2021: (not shipped) | `AmnestyTech/investigations/2021-07-18_nso/pegasus.stix2` | `df1bcaa78abc7b85…` | The licensor's research combined with indicators first published by others | **excluded** | Amnesty Security Lab and partners (Pegasus Project); README says part of it (v2 domains) was first published by the Citizen Lab. The publisher's licence alone does not establish permission for the third-party portion. Excluded until clarified. |
| mvt-predator: (not shipped) | `mvt-project/mvt-indicators/intellexa_predator/predator.stix2` | `99938ba179216f73…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| mvt-rcs-lab: (not shipped) | `mvt-project/mvt-indicators/2022-06-23_rcs_lab/rcs.stix2` | `db7473900259bc28…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| echap-stalkerware: `spyware/feeds/echap-stalkerware.stix2` | `AssoEchap/stalkerware-indicators/generated/stalkerware.stix2` | `60307b49256d726a…` | The licensor's own research | **included** (6083 indicators) | Echap's own stalkerware and watchware research, maintained by Julien Voisin and Tek, per the README. |
| amnesty-android-campaign-2023: `spyware/feeds/amnesty-android-campaign-2023.stix2` | `AmnestyTech/investigations/2023-03-29_android_campaign/malware.stix2` | `28da50042006281d…` | The licensor's own research | **included** (2187 indicators) | Amnesty International report "New Android Hacking Campaign Linked To Mercenary Spyware Company" (Mar 2023), per the folder README. |
| mvt-quadream-kingspawn: (not shipped) | `mvt-project/mvt-indicators/2023-04-11_quadream/kingspawn.stix2` | `fd47acd303887380…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| mvt-operation-triangulation: (not shipped) | `mvt-project/mvt-indicators/2023-06_01_operation_triangulation/operation_triangulation.stix2` | `320a3aa1147f7c87…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| mvt-wyrmspy-dragonegg: (not shipped) | `mvt-project/mvt-indicators/2023-07-25_wyrmspy_dragonegg/wyrmspy_dragonegg.stix2` | `b5495ca605b2150e…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| amnesty-wintego-helios-2024: `spyware/feeds/amnesty-wintego-helios-2024.stix2` | `AmnestyTech/investigations/2024-05-02_wintego_helios/wintego_helios.stix2` | `d0d546c388207e8a…` | The licensor's own research | **included** (175 indicators) | Amnesty International Security Lab research (internet scanning), per the folder README. |
| amnesty-novispy-2024: `spyware/feeds/amnesty-novispy-2024.stix2` | `AmnestyTech/investigations/2024-12-16_serbia_novispy/novispy.stix2` | `02bfceea5a2c32b1…` | The licensor's own research | **included** (18 indicators) | Amnesty International Security Lab forensic research, per the folder README. |
| mvt-eaglemsgspy: (not shipped) | `mvt-project/mvt-indicators/2024-12-25_eaglemsgspy/eaglemsgspy.stix2` | `033af3e26f764ace…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| mvt-candiru: (not shipped) | `mvt-project/mvt-indicators/candiru/candiru.stix2` | `684f9e60da472ec9…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| mvt-residentbat: (not shipped) | `mvt-project/mvt-indicators/ResidentBat/residentbat.stix2` | `d52ca6753a80578a…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| mvt-cellebrite: (not shipped) | `mvt-project/mvt-indicators/cellebrite/cellebrite.stix2` | `054436c35a1e715f…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| mvt-darksword: (not shipped) | `mvt-project/mvt-indicators/2026-03-30_darksword/darksword.stix2` | `a694a8f3a37866ae…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| mvt-coruna: (not shipped) | `mvt-project/mvt-indicators/2026-03-03_coruna_cryptowaters/coruna.stix2` | `653887014af347a1…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| mvt-morpheus: (not shipped) | `mvt-project/mvt-indicators/2026-04-23_ips_morpheus/morpheus.stix2` | `fa327338e33b017f…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| mvt-btmob: (not shipped) | `mvt-project/mvt-indicators/2026-05-26_btmob/btmob.stix2` | `6bada3d46e6ac530…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| mvt-spyrtacus: (not shipped) | `mvt-project/mvt-indicators/2026-04-09_sio_spyrtacus/spyrtacus.stix2` | `44a7f68629cfeb59…` | Compiled from other organisations' published reports | **excluded** | Compiled by the MVT project from other organisations' published reports (see the folder README / indicators.yaml). MVT's MIT licence is a compiler's licence; excluded until the reuse basis is clarified. |
| amnesty-nso-2018: `spyware/feeds/amnesty-nso-2018.csv` | `AmnestyTech/investigations/2018-08-01_nso/indicators.csv` | `4e450de9219a6cb9…` | The licensor's own research | **included** (1208 indicators) | Amnesty International NSO investigation (Aug 2018); folder has no README, attributed to Amnesty by the repository and the MVT index. |
| amnesty-nso-morocco-2019: `spyware/feeds/amnesty-nso-morocco-2019.txt` | `AmnestyTech/investigations/2019-10-10_nso_morocco/domains.txt` | `29c183256cee9c04…` | The licensor's own research | **included** (8 indicators) | Amnesty International Morocco investigation (Oct 2019); folder has no README, attributed to Amnesty by the repository and the MVT index. |
| amnesty-cytrox-2021: (not shipped) | `AmnestyTech/investigations/2021-12-16_cytrox/cytrox.stix2` | `6fe92193d9e17c21…` | The licensor's research combined with indicators first published by others | **excluded** | README: first published by Meta and the Citizen Lab (Dec 2021), plus indicators found by Amnesty. The publisher's licence alone does not establish permission for the third-party portion. Excluded until clarified. |
| amnesty-finfisher-2020: `spyware/feeds/amnesty-finfisher-2020.txt` | `AmnestyTech/investigations/2020-09-25_finfisher/domains.txt` | `cc5d59d5f868984b…` | The licensor's own research | **included** (4 indicators) | Amnesty Tech report "German-made FinSpy spyware found in Egypt" (Sept 2020), per the folder README. |
| citizenlab-nso-2016: (not shipped) | `citizenlab/malware-indicators/201608_NSO_Group/iocs.csv` | `7c005140f65b4043…` | The Citizen Lab's own research | **excluded** | CC BY-NC-SA 4.0: NonCommercial conflicts with a site carrying ads and donations. |
| citizenlab-cyberbit-2017: (not shipped) | `citizenlab/malware-indicators/201712_Cyberbit/iocs.csv` | `3ca53475a3c96630…` | The Citizen Lab's own research | **excluded** | CC BY-NC-SA 4.0: NonCommercial conflicts with a site carrying ads and donations. |
| citizenlab-kingdom-2018: (not shipped) | `citizenlab/malware-indicators/201810_TheKingdomCameToCanada/iocs.csv` | `835b1a105a4f16b9…` | The Citizen Lab's own research | **excluded** | CC BY-NC-SA 4.0: NonCommercial conflicts with a site carrying ads and donations. |
| citizenlab-nso-mexico-exploit-2017: (not shipped) | `citizenlab/malware-indicators/201706_RecklessExploit/iocs.csv` | `b260da1f4e1dd15c…` | The Citizen Lab's own research | **excluded** | CC BY-NC-SA 4.0: NonCommercial conflicts with a site carrying ads and donations. |
| citizenlab-nso-mexico-redux-2017: (not shipped) | `citizenlab/malware-indicators/201706_RecklessRedux/iocs.csv` | `62d614e4f11a1652…` | The Citizen Lab's own research | **excluded** | CC BY-NC-SA 4.0: NonCommercial conflicts with a site carrying ads and donations. |
| citizenlab-nso-insider-2017: (not shipped) | `citizenlab/malware-indicators/201707_InsiderInfo/indicators.csv` | `87cd4cb85b4a3808…` | The Citizen Lab's own research | **excluded** | CC BY-NC-SA 4.0: NonCommercial conflicts with a site carrying ads and donations. |
| (not shipped) | Zero Breach Toolkit `iocs/curated_mercenary.txt` | — | Compiled from other organisations' published reports | **excluded** | Values read from Citizen Lab reports; the curator's CC0 declaration alone does not establish the reuse basis. Excluded until clarified. |
| (not shipped) | Zero Breach Toolkit `iocs/adfection_iocs.txt` | — | Compiled from other organisations' published reports | **excluded** | Values read from Citizen Lab reports; the curator's CC0 declaration alone does not establish the reuse basis. Excluded until clarified. |

## Notices

- Amnesty International files: CC BY 2.0. Attribution: "Amnesty International Security Lab", with a link to the repository, on the spyware-check page and in this file. Files are unchanged.
- Echap file: CC BY 4.0. Attribution: "Echap" (maintained by Julien Voisin and Tek), with a link to the repository and licence, on the page and in this file. File unchanged.
- No MIT-licensed data is shipped at present, so no MIT notice is required for data.

## Shipped totals

7 files, 9506 unique indicators after de-duplication.