@Valdo
He might be victim of kr00k attack.
https://www.zdnet.com/article/new-kr00k-vulnerability-lets-attackers-decrypt-wifi-packets/

Seems like popular way now to steal wifi credentials and more