~snip~
The only thing you can blame is yourself, or maybe the security of the metamask software if it was, or if it was a hardware, the security features are so much vulnerable. Also, yourself are subjected to expose your private keys in order for the hackers to access your accounts.
Oi oi oi, he did not ask you to scold him but instead he was asking you a solution to his problem.
Your tokens are on his wallet right now, what do you mean by stuck? it is impossible for you to take it back if you do not know his private key.
and do not forget that your PC might be affected by some malware, it would be better for you to wipe it out first before using it again.