A man boarded domestic flights across Australia with a small handheld device switched on inside his bag. Within minutes, phones and laptops around him quietly connected to a Wi-Fi network broadcasting a name they already trusted. No one noticed anything wrong — because nothing looked wrong. In November 2025, he was sentenced to seven years and four months in prison for it.

That device was a rogue access point, and the technique is called an evil twin attack. It doesn’t require breaking encryption, guessing a password, or exploiting a software bug — just convincing a device to connect to the wrong network. Every device in your pocket has been trained since the day it was made to do exactly that.

TL;DR

  • An evil twin is a fake Wi-Fi access point broadcasting the same (or a near-identical) SSID as a trusted network, positioned to intercept everything a victim sends once they connect.
  • Devices connect automatically because of saved-network auto-connect behavior and because Wi-Fi has no built-in way to cryptographically verify who is operating a given SSID.
  • Deauthentication frames — a management message that was never encrypted or authenticated in the original 802.11 standard — let an attacker forcibly disconnect a victim from the real network to push them toward the fake one.
  • 802.11w Protected Management Frames (PMF), mandatory under WPA3, close most of the classic deauth attack — but academic research has shown bypasses still exist, and WPA3-Personal still can’t verify network identity, only encrypt the link to whatever AP the device connects to.
  • A convicted case from Australia (2024–2025) and a $600,000 FCC fine against Marriott (2014) show this isn’t theoretical — it has already produced real prosecutions and real regulatory penalties.
  • The strongest defenses combine protocol-level protections (PMF, WPA3-Enterprise with certificate validation), device hygiene (disabling auto-connect, forgetting old networks), always-on VPN, phishing-resistant MFA, and enterprise WIDS/WIPS monitoring for rogue APs.

Why This Matters to You

If you have ever connected to “Starbucks WiFi,” “Airport_Free_WiFi,” or a hotel guest network without verifying who controls it, you’ve exposed yourself to this attack — whether you’re a business traveler, a student, or an employee on a corporate guest SSID. The moment a device auto-joins a familiar-looking name, the attacker controls everything that flows through it.

For security teams, evil twins matter because they sidestep controls built around securing the destination — endpoint protection, firewalls, DLP — by attacking the path traffic takes to get there. A fully patched laptop with EDR offers no resistance once its user has handed their traffic to an attacker’s access point.

Table of Contents

What an Evil Twin Attack Actually Is

An SSID (Service Set Identifier) is simply the network name your device displays when you scan for Wi-Fi — “Airport_Free_WiFi,” “HotelGuest,” whatever a network operator decided to call it. Nothing about an SSID is cryptographically tied to the physical hardware broadcasting it. Any device with a Wi-Fi radio can broadcast any SSID it wants.

An evil twin attack exploits exactly that gap. An attacker sets up their own access point (AP) — a device that creates a Wi-Fi network — and configures it to broadcast the same SSID as a legitimate, trusted network nearby, sometimes as an exact clone and sometimes as a close lookalike (“Hotel_WiFi” vs. “Hotel-WiFi_Guest”) designed to catch a victim who isn’t reading carefully.

Once a victim’s device connects to the evil twin instead of the real network, the attacker sits in the middle of every packet that device sends or receives — a textbook man-in-the-middle (MitM) position, established at the radio layer before any application-layer security even gets a chance to run.

This is a different problem from Wi-Fi client isolation bypass, where an attacker is already a legitimate client on the real network and breaks the wall meant to separate them from other guests. An evil twin attack happens one step earlier — the attacker doesn’t join the real network at all. They build a fake one and wait for you to join it instead.

How the Attack Works, Step by Step

At a mechanical level, an evil twin attack follows a predictable sequence — explained here for defensive literacy, not as an operational how-to.

Reconnaissance and cloning. The attacker identifies a target SSID worth cloning — an airport, hotel, coffee shop, or corporate guest network — noting its band, whether it’s open or password-protected, and whether it presents a captive portal (the login page shown before internet access is granted). They configure their own AP hardware to broadcast an identical or near-identical SSID, often on the same channel; devices generally prefer the strongest available signal for a known SSID, so a closer attacker has a natural advantage.

Pushing victims toward the fake network. Devices already connected to the real network need a reason to leave it — this is where deauthentication frames come in, covered next.

Capturing the connection. Once the victim associates, the attacker’s device becomes their default gateway. If the real network used a captive portal, the attacker often clones that too, capturing whatever the victim types regardless of HTTPS — because the victim is typing directly into infrastructure the attacker controls.

Interception and beyond. From this position, the attacker can log unencrypted traffic, attempt TLS stripping against sites that don’t enforce HTTPS strictly, or simply capture metadata — DNS lookups, visited domains, session cookies on any site not using modern protections.

Why Deauthentication Frames Are the Attacker’s Favorite Tool

Wi-Fi’s 802.11 standard defines two broad categories of traffic: data frames (actual internet traffic) and management frames (housekeeping messages that let devices join, leave, and coordinate with a network). One management frame type is the deauthentication frame — a message telling a device “you are now disconnected from this network.”

The problem, present since the earliest Wi-Fi security standards, is that 802.11 never required deauthentication frames to be encrypted or authenticated. Any device within radio range can forge one, spoof the source address of a legitimate AP, and send it to a victim — whose device, having no way to verify the frame is genuine, complies and disconnects.

For an evil twin attacker, this is the missing piece: instead of waiting for a victim to wander out of range of the real network, they can force a disconnection on demand, repeatedly, until the victim’s device — desperate to reconnect to a network with the right SSID — associates with the attacker’s clone instead.

This isn’t theoretical. In 2014, the U.S. Federal Communications Commission fined Marriott $600,000 after the hotel chain used its Wi-Fi monitoring system to send deauthentication frames against guests’ personal mobile hotspots at the Gaylord Opryland Hotel in Nashville — not to protect guests, but to push conference attendees onto Marriott’s own paid Wi-Fi, which cost as much as $1,000 per device. Marriott ultimately conceded the personal hotspots posed no actual security threat; the FCC’s consent decree barred the practice going forward.

Why Devices Connect Without Being Tricked: Auto-Connect and KARMA

A striking feature of evil twin attacks is that victims often don’t need to be fooled at all — their devices connect on their own.

Most phones and laptops maintain a Preferred Network List (PNL): a memory of every Wi-Fi network the device has connected to before, typically set to reconnect automatically without asking. When Wi-Fi is enabled, the device periodically broadcasts probe requests — small unencrypted messages effectively asking “is any network from my saved list nearby?” — so it can rejoin known networks without user interaction.

This is convenient, and also a beacon. A technique known as the KARMA attack, first documented by researchers Dino Dai Zovi and Shane Macaulay in 2004, exploits it directly: an attacker’s AP listens for probe requests and responds “yes” to every one, regardless of what SSID was actually requested. A device that once connected to “Airport_Free_WiFi” at any airport, anywhere, will happily reconnect to an attacker’s AP claiming to be that exact network — no deauth frame required, because the device was never connected to anything to begin with.

Modern operating systems have pushed back on parts of this: iOS and recent Android versions use MAC address randomization for probe requests and have reduced how aggressively they broadcast full preferred network lists. Older laptops, budget Android devices, and Wi-Fi-connected IoT hardware — printers, cameras, smart displays — remain far more exposed, and many auto-connect with none of these protections at all.

Does WPA3 Actually Fix This?

Partially. The IEEE ratified 802.11w in 2009 to address the unauthenticated management-frame problem: it adds a cryptographic Message Integrity Check (MIC), generated using a shared Integrity Group Temporal Key (IGTK), to management frames including deauth and disassociation messages. A device with Protected Management Frames (PMF) enabled simply discards a forged deauth frame that doesn’t carry a valid signature.

WPA3 makes PMF mandatory. Under WPA2, PMF was optional and rarely enabled; under WPA3, a device can’t complete the handshake without it, closing off the simplest deauth tooling against fully-migrated networks. It isn’t a complete fix, though: the 2022 paper “Cut It: Deauthentication Attacks on Protected Management Frames in WPA2 and WPA3” (Lounis, Ding, and Zulkernine) demonstrated deauth attacks remain feasible against PMF-enabled WPA2 and WPA3-Personal networks under certain conditions, exploiting implementation gaps rather than breaking the cryptography.

More fundamentally, WPA3 — including PMF — does not by itself establish that an AP belongs to the organization named in its SSID. On a WPA3-Personal network, however, a convincing clone normally also needs the correct pre-shared password to complete authentication; merely copying the SSID is not enough. Open public networks and lookalike SSIDs remain easier targets because users may join them without that shared-secret check.

WPA3-Enterprise closes much of this gap, but only when clients validate the expected authentication server. With correctly configured EAP-TLS, the client validates the network’s server certificate before transmitting credentials, and the network validates the client. Most coffee shops, airports, and hotels instead use open networks, captive portals, or a shared password, none of which gives a managed client the same organization-specific identity check.

A partial upgrade exists for open networks too: Wi-Fi Enhanced Open, built on Opportunistic Wireless Encryption (OWE), encrypts traffic on password-free networks like most cafés and airports. It stops passive eavesdropping, but like WPA3-Personal, it can’t confirm the AP’s identity — an evil twin cloning an Enhanced Open network defeats it the same way.

The Tools Behind Evil Twin Attacks

Understanding what attackers actually use — at a conceptual level, not as a how-to — helps defenders recognize the pattern rather than a specific product.

Software-based rogue APs are commonly built on Linux with tools like hostapd (an access point daemon that turns a standard Wi-Fi adapter into a functioning AP), letting anyone with commodity hardware stand up a cloned network. Framework tools such as airgeddon bundle deauthentication, AP cloning, and captive portal generation into a single guided workflow, originally built for authorized penetration testing.

Purpose-built hardware takes this further. The WiFi Pineapple (Hak5) is a commercially sold, pocket-sized device for wireless penetration testing that automates AP cloning, KARMA-style capture, and captive portal deployment through a web interface. It’s marketed for authorized assessments — and its “Evil Portal” module is the same category of tool the Australian in-flight attacker used against real victims.

Captive portal cloning is the piece that actually harvests credentials: a pixel-accurate copy of a network’s login page captures whatever a victim types — loyalty numbers, “accept terms” checkboxes, social logins for “free” Wi-Fi — regardless of HTTPS, because the victim isn’t talking to the real service at all. Generative AI has made producing a convincing clone a matter of minutes, lowering the skill floor for this step considerably.

Real-World Cases: This Isn’t Hypothetical

Australia — in-flight and airport evil twin campaign (2024–2025). In April 2024, Australian Federal Police began investigating after a flight crew member noticed a Wi-Fi network suspiciously mimicking a legitimate airline or airport network. Officers searched a passenger’s luggage on arrival at Perth Airport and seized a WiFi Pineapple, a laptop, and a phone. Forensic analysis found the man had broadcast SSIDs matching legitimate airport and in-flight networks across Perth, Melbourne, and Adelaide, redirecting victims to phishing pages that harvested social media credentials — which he then used to access victims’ private messages, images, and videos. He was sentenced in November 2025 to seven years and four months in prison on nine charges, including unauthorized data access, theft, and evidence destruction.

Marriott / Gaylord Opryland — deauth abuse for commercial gain (2014). This case shows the deauthentication piece of the evil twin toolkit weaponized outside a traditional “attack”: a hotel operator used the same technique to disconnect guests from their own personal hotspots, pushing them onto the hotel’s paid network instead. It’s a reminder that the underlying 802.11 weakness is powerful enough to misuse even without cloning an SSID.

SANS ISC — rogue AP demo at a corporate security event (2016). Security researcher Xavier Mertens documented setting up a WiFi Pineapple at a corporate event as an awareness exercise. Multiple attendees’ phones connected automatically without any user action — including a smartwatch that connected even though its paired phone had Wi-Fi disabled. It’s small-scale, but it illustrates the same auto-connect dynamic behind every KARMA-style attack, against security-aware participants who still got caught.

Together, these cases span a decade and three different motives — criminal fraud, commercial coercion, and security awareness testing — evidence that the underlying weakness is structural, not a one-off bug.

Detection: How Defenders Spot Rogue Access Points

Enterprise: WIDS/WIPS

A Wireless Intrusion Detection/Prevention System (WIDS/WIPS) is purpose-built infrastructure — dedicated sensors or capability built into enterprise access points — that continuously scans the RF (radio frequency) environment and classifies every AP it sees: managed infrastructure, known neighboring networks, or unclassified/rogue devices. Detection signals typically include:

  • SSID/BSSID mismatches — your organization’s SSID broadcast from a BSSID (the AP’s unique hardware identifier) not in your asset inventory.
  • Signal strength anomalies — an AP claiming to be fixed and known, but with signal characteristics consistent with movement or a position closer than the real AP.
  • Unusual beacon intervals or capability sets — cloned APs built with commodity software often broadcast subtly different capability flags than the vendor hardware they imitate.
  • Sudden spikes in deauthentication or disassociation frames — a strong indicator someone is actively forcing clients off the legitimate network.

Enterprise platforms — Cisco’s Air Marshal within Meraki, and equivalents elsewhere — can also engage active containment, sending deauth frames at a detected rogue AP or its clients to sever the connection. This is powerful but worth deploying carefully: it’s the same technique Marriott was fined for misusing.

Individual and small-team indicators

You don’t need enterprise WIDS to notice red flags: duplicate SSIDs in a Wi-Fi scan (two networks with an identical name, one unexpectedly strong); a missing or different password prompt on a network you’ve used before; a captive portal asking for information it’s never asked for, like a social media login instead of a room number; and unexpected certificate warnings right after connecting — a symptom of a MitM position attempting to intercept TLS traffic.

What You Can Do Today

If you’re an individual connecting to public Wi-Fi:

  1. Turn off Wi-Fi auto-connect for public/open networks, and periodically forget saved networks you no longer use — this alone defeats KARMA-style capture.
  2. Use a VPN before doing anything sensitive on public Wi-Fi. A correctly configured full-tunnel VPN sharply limits traffic interception after the tunnel is established, but it does not make a hostile network harmless: connection metadata, traffic before tunnel establishment, captive-portal phishing, and VPN blocking can still matter.
  3. Verify the SSID with staff before connecting at a hotel, airport, or café, especially when more than one network shares a similar name.
  4. Use phishing-resistant MFA (FIDO2/passkeys) wherever available — it resists credential capture even from a captive portal clone, because the cryptographic handshake is bound to the real domain, not to whatever network you’re on. See our passkeys and FIDO2 guide.
  5. Treat unexpected certificate warnings as a hard stop, not something to click through.

If you manage IT or security for an organization:

  1. Deploy WIDS/WIPS coverage across office and guest wireless footprints, with alerting tuned to SSID spoofing and deauth spikes — not just containment left on by default.
  2. Move enterprise Wi-Fi to WPA3-Enterprise with correctly configured EAP-TLS wherever feasible; certificate validation gives managed clients strong cryptographic evidence that they are joining the intended network, rather than merely an AP using the expected SSID.
  3. Enforce PMF (802.11w) on every SSID you control — a checkbox on virtually all modern enterprise AP platforms that closes off commodity deauth tooling.
  4. Push MDM policies that disable auto-connect to open/unknown networks, and maintain an allow-list of approved SSIDs.
  5. Train reception, helpdesk, and travel-heavy staff to recognize and report duplicate SSIDs — the same muscle used in physical social engineering awareness training applies directly here.
  6. Require an always-on, full-tunnel VPN for devices that travel, so a successful evil-twin connection exposes far less useful traffic after the tunnel is established.

Sources