ClickFix Edition 2: Ten Seconds of Forensic Evidence.

Post-execution forensics of an AMOS-like credential stealer on macOS 13: the unified log timeline, the TCC bypass, the kernel's unsigned module warnings, and the one thing the logs can't directly prove.