document everything; time, activity, other witnesses.
does you company have a HR dept? check handbook and see if any suspicious activity can be reported anonymously.
since it appears the boss doesn't care or is blind to it, you'll likely have to go over them also.
take a look from the outside...