Cybersecurity glossary
What is an Evil Twin Attack?
Learn what an evil twin attack is, how a lookalike Wi-Fi network intercepts traffic and credentials, how it differs from a rogue access point, and how to connect more safely.
Definition
An evil twin is a rogue wireless access point that impersonates a legitimate network’s name (SSID)—and often its login portal—so nearby users connect to an attacker-controlled hotspot instead of the real hotel, café, airport, or office Wi-Fi.
Why a familiar network name is not proof of a familiar network
People pick Wi-Fi the same way they pick email senders: by a label they recognize. An evil twin exploits that shortcut. The attacker broadcasts the same SSID as the hotel, airport lounge, conference hall, or corporate guest network. The radio looks like hospitality. The operator behind it is not.
The social-engineering piece is quiet. Nobody has to click a lure in a message. The user performs a normal travel behavior—join Wi-Fi, accept the portal, get to work. From that moment the hostile AP can present a cloned splash page, downgrade or intercept poorly protected traffic, and sit in the path of every subsequent request.
Open public networks make this easy. Even password-protected hotspots can be cloned if the shared passphrase is printed on a receipt, reused across venues, or simply known to anyone who already connected.
How an evil twin is built and used
Pick a trusted SSID
Copy a busy venue or office network name that devices already display or remember.
Outcompete the real AP
Raise transmit power, sit closer to victims, or wait for the legitimate hotspot to fail or fill up.
Accept associations
Phones and laptops join automatically or users pick the familiar name from the list.
Present a believable portal
Serve a lookalike login, ‘accept terms’, or SSO page that captures credentials or session cookies.
Relay or inspect traffic
Forward some traffic to keep the connection useful while intercepting what TLS does not protect.
Monetize access
Steal accounts, inject content, pivot toward the user’s other sessions, or plant further malware lures.
What victims actually lose
Portal credential harvest
Users type hotel, airline, or even corporate passwords into a page that only looks like the venue’s captive portal.
Session and cookie theft
Cleartext sites, misconfigured apps, and some ‘continue’ flows leak tokens the attacker can replay elsewhere.
Hostile content injection
Unprotected HTTP responses can be modified to add malware, extra forms, or fake software-update prompts.
Long-lived auto-join risk
Once a device saves the SSID, it may prefer the attacker’s radio again in another city without a new warning.
Evil twin versus nearby wireless threats
| Technique | Disguise | What the user does |
|---|---|---|
| Evil twin | Copies a trusted SSID and often the portal | Joins a network they believe they already know |
| Rogue access point | May use a new name or hide on a LAN | May never choose it; it can sit as unauthorized infrastructure |
| Open ‘Free Wi-Fi’ lure | Attractive new SSID, not necessarily a clone | Chooses convenience over a known venue network |
| Wired MITM | No radio impersonation | Uses a network already considered internal |
Enterprise 802.1X with validated server certificates changes the game: the client authenticates the network, not just the other way around. Shared passwords and open SSIDs cannot offer that guarantee.
Practical defenses for travelers and for network owners
- Ask staff for the exact SSID and treat lookalikes, extra hyphens, and duplicate names as hostile.
- Turn off auto-join for public and guest networks; forget venue Wi-Fi when you leave.
- Never enter work, bank, or email passwords into a browser captive portal. Use a guest code or a separate low-privilege flow.
- Prefer cellular tethering or a trusted VPN after association, understanding that a fake portal can still steal credentials before the tunnel starts.
- Treat TLS certificate warnings on public Wi-Fi as an immediate disconnect, not a click-through.
- For offices, require 802.1X (WPA2/WPA3-Enterprise) with server-certificate validation and disable insecure fallbacks.
- Run wireless IDS that alerts when unknown BSSIDs advertise your SSIDs, including guest names.
- On managed devices, restrict which SSIDs may be joined and block user installation of extra trusted certificate authorities.
A note on “I used HTTPS so I am fine”
Transport encryption is necessary and still insufficient here. The evil twin’s highest-value trick is often not decrypting your bank session. It is convincing you that the next page in the browser is the bank, the VPN client, the hotel login, or the software update you were about to install. The radio lie sets up the page lie.
The practical takeaway
An evil twin is social engineering at layer two: a trusted name on a hostile access point. Users join it because the SSID matches muscle memory. Attackers then harvest portal passwords, intercept weak sessions, or inject follow-on lures.
Verify the network the same way you verify a payment request—out of band. On corporate Wi-Fi, authenticate the access point, not only the user. On public Wi-Fi, assume the strongest signal with a familiar name may not be the venue you think it is.
Related security terms
Rogue Access Point
The broader unauthorized AP class; an evil twin is the impersonating variant that copies a trusted SSID.
Man-in-the-Middle (MITM)
Once victims join the fake network, the operator can intercept, modify, or relay their traffic.
Phishing
Many evil twins pair the fake radio with a cloned captive portal that harvests passwords.
Session Hijacking
Cleartext or poorly protected sessions on a hostile network can be stolen after association.
Social Engineering
The attack depends on users trusting a familiar network name and a familiar ‘click to get online’ ritual.
Frequently asked questions
What is an evil twin attack in simple terms?
Someone sets up a Wi-Fi network with the same name as a real one—like the airport or hotel hotspot—so your device joins theirs. They can then show a fake login page or watch traffic that is not properly encrypted.
Is an evil twin the same as a rogue access point?
A rogue access point is any unauthorized AP. An evil twin is a rogue AP that specifically copies a trusted SSID so people choose it on purpose or auto-join it.
Why do phones and laptops join evil twins?
Devices prefer known SSIDs, stronger signal, and open networks that match a saved name. Attackers can out-shout the real AP or wait until the legitimate network is down.
Does HTTPS stop evil twin attacks?
HTTPS protects data to correctly authenticated sites, but users can still type credentials into a fake captive portal, ignore certificate warnings, or leak traffic to apps that do not validate TLS well.
Can WPA2-Personal shared passwords stop this?
Not if the attacker also knows or guesses the café password, or if the network is open. Shared PSK also does not authenticate the access point to the client the way enterprise 802.1X can.
What should users do on public Wi-Fi?
Confirm the SSID with staff, avoid auto-join, skip entering work passwords in browser portals, prefer a trusted VPN or cellular data, and treat certificate errors as a hard stop.
How do enterprises detect evil twins?
Wireless intrusion detection looks for unauthorized BSSIDs advertising corporate SSIDs, unusual beacon patterns, and clients associating off-network. 802.1X plus server-certificate validation stops clients from joining lookalikes.
References
Explore authoritative guidance and frameworks related to evil twin.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.