Do not perform any transactions until your device is clean.
Or much better, buy a new device, then create a new email, get a new simcard dedicated only for crypto activities, and create new accounts. Also, don't just make one email. Make a few emails with different strong passwords for different purposes. Avoid connecting the new email to his previous email in his old phone or using his previous mobile number for his new accounts, whether on email or on different crypto related websites. He shouldn't download any unnecessary files or visit clearly unsafe websites that are riddled with ads. Keep it clean. Stay away from downloading apps outside the official website or app store. A budget to midrange phone isn't much compared to the security and peace of mind he will get. Even an Android phone will do. There's no need for flagship device.
I almost forgot, avoid connecting to any public wifi and clicking suspicious emails or links on social media. If possible, avoid using social media on his new phone so he won't misclick links. Block right away anyone on social media that you don't know who sends you a link. Anyway, it is easy to spot if the account is fake or not.
Remove that too much curiosity of yours so you don't just click here, click there, dl this, and dl that. If you do that again, your new device will be useless if you don't change that habit. You'll end up in the same situation again.