An Evil Twin is a rogue wireless access point configured to broadcast the exact same SSID name as a legitimate, trusted network, designed to intercept client traffic.
1. Hijacking Connections
Many devices automatically reconnect to known SSID names if the signal strength is stronger. An attacker places an Evil Twin closer to targets, sending deauth packets to drop targets off the real network. The targets automatically reconnect to the attacker’s stronger Evil Twin node.
2. Captive Portal Harvesting
The Evil Twin serves a login page (captive portal) claiming a system update is mandatory, harvesting WPA2 password inputs as they are typed.
3. Prevention
Configure enterprise devices to validate access point MAC addresses and server certificates before logging in.