Evil Twin Attacks: How Fake Wi-Fi Hotspots Work and How to Detect Them

How an evil twin attack runs end to end

The attacker starts with reconnaissance: a quick passive scan of the target environment to identify the SSID, BSSID, channel, encryption mode and any connected clients of the legitimate access point. Any aircrack-ng or hcxdumptool workflow produces this information in under a minute. The attacker then clones the SSID into a hostapd configuration on their own laptop, matches the channel, and optionally matches the BSSID (trivial with ifconfig wlan0 hw ether AA:BB:CC:DD:EE:FF). The cloned SSID broadcasts on the same channel as the real one, and any client that sees the evil twin's signal stronger than the real AP will roam to it. To force the roam the attacker sends a short burst of deauthentication frames to the real AP, kicking associated clients off; half of them immediately reconnect to whichever SSID with that name has the best signal, which the attacker has arranged to be the evil twin.

Once a client associates, the attacker's laptop runs dnsmasq to hand out DHCP leases and resolve every DNS query to the attacker's own IP. iptables redirects all HTTP and HTTPS traffic on ports 80 and 443 to a local nginx instance running a captive-portal page. Modern operating systems (iOS, Android, ChromeOS, Windows 11, macOS) probe well-known URLs like captive.apple.com, connectivitycheck.gstatic.com, and www.msftconnecttest.com to detect captive portals and automatically pop up a browser sheet. The attacker's nginx returns a login page styled to match the legitimate network's operator — your ISP's logo, your employer's branding, the airport's colour scheme. The user types the password. The page posts the credential to the attacker's server and optionally redirects to the real internet so the user does not immediately notice.

Attack frameworks

All three frameworks automate the same underlying chain: hostapd for the rogue AP, aireplay-ng or mdk4 for deauth, dnsmasq for DHCP and DNS spoofing, iptables for traffic redirection, and a local web server for the portal. The difference is mostly in menu ergonomics and the set of pre-built phishing templates. Defensive detection does not change based on which framework an attacker used; the on-the-wire signature is nearly identical.

Why WPA2-PSK and WPA3 transition mode do not save you

A common misconception is that WPA2 encryption defeats evil twins because the attacker does not have the PSK. That is partially true but misses the threat model. The attacker has two options. Option A: run the evil twin as an open (unencrypted) network with the same SSID. Devices that have the legitimate network saved in open mode — every hotel, airport, cafe and conference network — will connect without hesitation, because iOS, Android and Windows treat "same SSID, open security" as a continuation of a previously joined open network. Option B: run the evil twin with WPA2-PSK using a PSK the attacker has already harvested from a previous handshake crack. Clients that have the PSK stored will authenticate transparently. The attacker does not need to be a WPA2 peer of the original; they only need the PSK, which they got from any of the offline attacks described in our PMKID guide.

WPA3 with SAE does add mutual authentication, which raises the bar significantly. However, almost every WPA3 deployment in 2026 runs in transition mode (WPA2/WPA3 mixed) to support legacy devices, and the attacker simply forces the WPA2 code path. Pure WPA3-only deployments do defeat the classic evil twin; very few consumer and enterprise networks are pure WPA3-only yet.

User-side detection signals

Enterprise defences: WIPS and 802.1X

Home users cannot deploy a Wireless Intrusion Prevention System, but enterprise operators can and should. A WIPS consists of dedicated sensors — either standalone radios or integrated into enterprise access points (Cisco Meraki, Aruba, Ubiquiti, Juniper Mist) — that continuously monitor the RF environment for BSSIDs with known corporate SSIDs but unknown OUIs, rapid deauth bursts, hostapd-style DHCP fingerprints, and similar anomalies. When the WIPS detects a likely rogue, it can either alert or automatically emit deauth frames at the rogue to keep clients off (legal grey area in some jurisdictions; vendor defaults usually alert-only).

On the client side, the durable defence is 802.1X / EAP-TLS with server certificate validation. Instead of a shared PSK, every device authenticates with a client certificate and validates the RADIUS server's certificate. A rogue AP cannot forge the server certificate, so clients refuse to complete EAP. The catch is that certificate validation must actually be enforced; operating systems historically allowed users to click through cert warnings, and enterprises that shipped self-signed certificates trained their users to always click "trust". Modern MDM-enrolled devices pin the expected server certificate common name or SHA-256 fingerprint, which closes this gap.

Home and travel defence checklist

Real-world incident anatomy

To make the theoretical threat concrete, consider a real pattern seen repeatedly in coffee-shop and conference venues during 2024 and 2025. The attacker arrives with a laptop and a USB Wi-Fi adapter in monitor mode, sits at a corner table for ten minutes running hcxdumptool passively to enumerate nearby access points and their clients. They pick the target SSID — typically the free venue Wi-Fi because it is open and therefore auto-joins — and launch airgeddon with the captive portal template for that venue already pre-configured. The portal asks for an "email and confirmation code" supposedly sent by the venue's loyalty program; users who are in a hurry and assume they are dealing with yet another intrusive sign-up page paste their work email and a recent 6-digit code from their authenticator app. The attacker now has a valid email + TOTP pair which they can use for roughly 30 seconds against the target's Microsoft 365 or Google Workspace login.

A more sophisticated variant targets corporate networks specifically. The attacker first sits in the lobby of the target company running hcxdumptool to harvest PMKIDs from the corporate SSID. If the PSK is weak enough to crack offline (they usually are — corporate Wi-Fi PSKs rotate rarely and tend to be memorable), the attacker returns the next day with the PSK in hand, stands up a WPA2-encrypted evil twin using the captured PSK, and presents a captive portal styled to look like the company's Okta or Entra ID login. Users associate transparently because their device already has the PSK saved; the portal asks them to re-authenticate to the corporate SSO and harvests valid session cookies. Neither WPA2 nor basic 802.1X defeats this variant; only certificate-pinned EAP-TLS does.

Operating-system behaviour that makes the attack easier

Modern operating systems prioritise connectivity over security in several design decisions that make evil twins more effective than they should be. iOS and Android both auto-join known SSIDs aggressively: if you ever connected to "Starbucks WiFi" anywhere in the world, your phone will auto-join any open SSID with that name, anywhere. Windows 11's captive portal detection opens a non-sandboxed browser view at www.msftconnecttest.com that is easily redirected by the attacker's dnsmasq. macOS's captive portal assistant at captive.apple.com does validate the expected response string but silently falls back to a regular browser if anything looks off, which loads the attacker's page. ChromeOS's portal assistant does the same.

All four operating systems now offer settings to disable auto-join for individual networks, auto-forget networks not used in N days, or require explicit confirmation before joining any open network. These settings are not on by default and most users never change them. A privacy-conscious traveller spends a minute in Wi-Fi settings on each of their devices disabling auto-join for every "public" SSID they have ever touched, which is the single highest-leverage action an individual can take. For enterprises, pushing a device management policy that disables auto-join for non-corporate SSIDs and forces certificate validation on EAP methods removes most of the attack surface at once.

Relationship to handshake cracking and rogue AP detection

Evil twins and offline handshake attacks are complementary tools. An attacker who has cracked your WPA2 PSK offline (via a captured handshake or PMKID) can stand up an indistinguishable evil twin because they know the PSK; an evil twin attacker who cannot crack the PSK offline will often run an open twin and rely on user saved networks. Defensive hygiene against one attack improves posture against the other: a strong 20-character passphrase defeats the offline crack, and skepticism about captive portals defeats the twin. For the broader rogue-AP detection story including WIPS deployment and signature-based anomaly tools, see our rogue access point detection guide. For the underlying handshake mechanics that make the PSK crackable in the first place, see what is a WPA handshake.

Frequently asked questions