TryHackMe Hacker's Holiday 2026: Day 0 — The Brochure

Room: The Brochure Event: Hacker's Holiday Category: OSINT

Overview

The Brochure is a pure OSINT challenge with no VM to attack — the target here is a trail of social media breadcrumbs left behind a polished piece of marketing. The premise: Byte Lotus Resorts published a promotional flyer, and buried inside its design are the clues needed to track down an employee account that was never meant to be found. No terminal, no exploit — just careful reading and a willingness to follow a thread through three separate Instagram accounts.

Step 1 — Reading the brochure

The room hands you a single image: a glossy resort flyer for Byte Lotus Resorts, dated Mon Jul 27.

At first glance it's just marketing copy, but two lines stand out once you actually read them instead of skimming past them:

• "Some things aren't posted. Some clues are. Find us on Instagram… or not."
• "CONCIERGE_ — VERA can assist you with further information."_

The tagline at the bottom — "A polished first impression can still leave a trail" — is basically the room telling you outright what the objective is. The brochure isn't the deliverable, it's the pointer. Two names fall out of it immediately: a company account to search for, and a concierge named Vera who's apparently worth remembering.

Step 2 — Finding the resort's Instagram

Taking the brochure at its word, I searched Instagram for the resort and landed on @thebytelotusresort.

The profile itself is sparse — two posts, 540 followers — but the detail that matters is tucked away where most people wouldn't think to look: it's only following 1 account. A corporate resort page that follows exactly one other profile is not a coincidence in a room built around following a trail, so that's where I went next.

Step 3 — The one account it follows

Opening the "Following" list confirmed what the brochure had already hinted at:

The single account followed is @veratheconcierge, display name Vera — a direct match to the concierge named on the flyer. At this point the chain is obvious: brochure → resort account → the one account it follows → Vera.

Step 4 — Vera's profile and the split secret

Vera's bio reads simply: "Currently working for Byte Lotus Hotel." — enough to confirm she's the right lead, not enough to hand anything over for free. What she does hand over is stranger: three separate posts, each a near-identical sunset image, each with a fragment of text overlaid on it.

Each image contains a chunk of what's clearly encoded text — mixed-case alphanumerics, a couple of trailing = characters peeking out on the last one. Classic Base64 alphabet. Individually the fragments are meaningless; the room's design forces you to actually open each post rather than just glance at the grid preview, since the strings are cropped at the tile boundaries.

Step 5 — Reassembling the string

Opening the first post confirmed the plan explicitly — the caption reads "Part 1", with the fragment VEhNe1YzckBzX2FD sitting underneath it.

That confirmed there were three parts total, meant to be concatenated in order. Stitching all three fragments together end-to-end produced one continuous Base64 blob:

VEhNe1YzckBzX2FDQzB1bnRfaDRzX2IzM25fZjB1bmQhfQ==

VEhNe1YzckBzX2FDQzB1bnRfaDRzX2IzM25fZjB1bmQhfQ==

Step 6 — Decoding

Dropping that string into CyberChef's From Base64 recipe gave an immediate, clean decode:

THM{V3r@s_aCC0unt_h4s_b33n_f0und!}

THM{V3r@s_aCC0unt_h4s_b33n_f0und!}

Flag

THM{V3r@s_aCC0unt_h4s_b33n_f0und!}

THM{V3r@s_aCC0unt_h4s_b33n_f0und!}

Takeaways

This room is a good reminder that OSINT engagements rarely announce themselves — the "vulnerability" here was a marketing asset that leaked operational detail (an employee's identity and role) through careless copywriting, and a social account that leaked a secret by splitting it across multiple posts under the assumption nobody would bother reading all three. Real-world parallel: corporate social accounts routinely leak more than intended through who they follow, what they caption, and what they assume is "hidden in plain sight." The fix isn't technical — it's operational security awareness for anyone managing a brand's public accounts.