Snagging Creds from Locked Machines (malicious.link)

"If I plug in a device that masquerades as a USB Ethernet adapter and has a computer on the other end, can I capture credentials from a system, even when locked out (yes, logged in, just locked). (..or do even more, but we’ll save that for another time, this post is already too long)"

It looks like this is capturing network traffic, but why would that contain unencrypted credentials?

I skimmed this a few times and still don’t see the answer.