So he already had malware installed on his machine, and instead of logging keys or something else, it just stole the stored passwords. Not like that is some kind of new nefarious twist other than all the passwords being in one convenient place, I guess. A lot of the scare stories always make it sound like there is some massive new security flaw that we should be terrified of, but when you read the details, the person's machine was already compromised in some way.