An On-path attack(Man in the Middle) occurs when an attacker place themselves between two devices (often a web browser and a web server) and intercept or modify communications between the two.
In this question, the attacker was eavesdropping on the connection which means they placed themselves between the user and the shopping site and intercepted the communication.
The attacker had likely captured credit card information or account information from the site to be able to make the purchases.