Stego

A 16-frame APNG hides one flag character per frame in the top-left pixel of each frame’s decompressed scanline data; every standard stego avenue is a dead end, so decompressing all 16 fdAT/IDAT streams and reading byte 4 of each yields the flag.

A 4.9 MB rules PDF hides 360 fake 1×1 image XObjects holding base64 chunks that reassemble into an encrypted ZIP; the password is hidden in the rules text, inside is a Singularity .sif whose squashfs holds the flag.