Have him switch his teacher’s thumb drive with an identical one when he’s not looking… and that thumb drive would load a malicious program that runs a keylogger and sends entered keys to the attacker’s remote server.

​

EDIT: BTW I think most were using XP by then