Phishy GTA VI Game Files: Reading the Order of Images

Overview

The archive posed as leaked GTA VI game files — a classic phishing lure — and contained a folder of numbered JPEG images. Many of the images were visually similar or repeated.

Challenge brief

Inspect the "game files" and find what they are really hiding.

Analysis

Every file was first checked for embedded data using metadata and content analysis, ruling out appended archives and obvious EXIF payloads.

Comparing the images side by side showed the real clue: a rotating, repeated pattern across the numbered sequence. The images were symbols, and their order carried the information.

1exiftool -a -u images/*.jpg | less2for f in images/*.jpg; do file "$f"; done

Solution

Using the discovered ordering, the sequence was mapped back to characters and the hidden message reconstructed, giving the flag.

Flag

Redacted. Format: Bsides_Mumbai{…}.

Lessons learned

Not every forensics challenge hides bytes inside a file — sometimes the dataset's structure is the payload. Systematically rule out metadata and embedded files first, then look for patterns across files.