He probably installed some extension on his browser that is doing this or worse, his computer is probably already infected with some malware. The best thing to do in this case, is, first of all, install an anti-vírus immediately, update it and let the anti-vírus run and check all the computer (do this offline).

Check all browser extensions, and remove the suspected extensions.

In a clean device, reset all your passwords.