Evil Twin Attack: How Fake Wi-Fi Networks Steal Your Data

An evil twin attack is a cyberattack in which a criminal creates a fraudulent Wi-Fi access point that imitates a legitimate network. The fake network may use the same name or a deceptively similar name as the Wi-Fi offered by a hotel, airport, café, office or other trusted location.

When someone connects to the fraudulent access point, the attacker may place themselves between the user’s device and the internet. Depending on the security controls involved, the attacker may attempt to monitor traffic, redirect the user to malicious websites, display fraudulent login pages or collect information that the victim enters.

The US Cybersecurity and Infrastructure Security Agency, or CISA, describes an evil twin as a system configured to impersonate a legitimate public access point. NIST similarly warns that a rogue access point can allow an attacker to view or manipulate communications when a device connects to it.

How does an evil twin attack work?

Although individual attacks vary, most evil twin attacks follow the same general pattern.

1. The attacker identifies a trusted network

The criminal looks for the name of a Wi-Fi network used in a public or professional location.

Examples might include:

• Airport_Free_WiFi

• Hotel_Guest

• Conference_WiFi

• CoffeeShop_Guest

• Company_Office

The network name displayed to users is called the service set identifier, or SSID. An SSID is not proof that a network is genuine. Anyone with suitable equipment can broadcast a network using a familiar name.

2. A fraudulent access point is created

The attacker creates another wireless network using the same SSID or a name that is difficult to distinguish from the real one.

For example, a legitimate network called Hotel_Guest might be imitated using:

• Hotel_Guest

• Hotel-Guest

• Hotel_Guest_5G

• Hotel_Guest_Free

• HotelGuest

The fake access point might appear to offer a stronger signal because it is physically closer to the victim. However, signal strength alone cannot establish whether a network is genuine.

3. The victim connects

A user may select the fake network manually because its name looks legitimate. In other cases, a device may attempt to reconnect to a remembered network automatically.

The Federal Trade Commission advises businesses to disable automatic connections to public Wi-Fi on smartphones. The US National Security Agency also recommends disabling wireless features when they are not being used and prioritising a personal or corporate mobile hotspot over public Wi-Fi.

4. The attacker provides internet access

Many evil twin networks still provide a working internet connection. This reduces suspicion because websites and applications continue to load normally.

The victim’s traffic now passes through infrastructure controlled by the attacker before reaching the internet. This creates an opportunity for surveillance, redirection or phishing, although the attacker’s ability to read or modify the traffic depends heavily on whether the connection is properly encrypted.

5. The attacker attempts to capture information

The attacker may present a fraudulent captive portal: a page that appears before internet access is granted or redirect the user towards a fake sign-in page.

The page may ask for:

• An email address and password

• A social media login

• Workplace credentials

• A hotel room number

• Payment card information

• A telephone number

• A one-time authentication code

The attacker records the information entered into the page and may immediately attempt to use it on the legitimate service.

Is an evil twin attack a man-in-the-middle attack?

An evil twin attack and a man-in-the-middle attack are related, but they are not identical.

An evil twin describes the fraudulent Wi-Fi access point used to impersonate a legitimate network.

A man-in-the-middle attack, now also commonly called an adversary-in-the-middle attack, describes a situation in which an attacker positions themselves between two communicating parties.

The evil twin may provide the position from which an attacker attempts a man-in-the-middle attack, but merely connecting to an evil twin does not guarantee that every encrypted communication can be read.

Evil twin attack versus rogue access point

The terms are sometimes used interchangeably, but there is a distinction.

A rogue access point is any unauthorized wireless access point. It might be installed maliciously, or it might simply be an employee’s personal router connected without permission.

An evil twin is a more specific type of rogue access point deliberately configured to resemble a trusted network and deceive users.

NIST identifies rogue wireless devices as a significant risk because they may bypass normal network controls or allow attackers to observe and manipulate communications from devices that connect to them.

What information can an evil twin attacker steal?

The exact risk depends on the victim’s behaviour, the websites or applications being used and the security technologies protecting the connection.

Credentials entered into fraudulent pages

The most direct risk is credential phishing. When a victim types a username, password or verification code into a page controlled by the attacker, that information is delivered directly to the attacker.

Encryption does not solve this problem. A fraudulent website can have its own valid HTTPS certificate. In that situation, the information is encrypted while travelling to the criminal’s website—but the criminal owns the destination and can read what was submitted.

The FTC specifically warns that scammers can create encrypted fake websites. A padlock therefore indicates that the connection to a site is encrypted; it does not prove that the organisation operating the site is trustworthy.

Unencrypted network traffic

Traffic sent without HTTPS, a VPN or another encrypted protocol may be exposed to monitoring or modification.

This risk is lower than it was during the early years of public Wi-Fi because most major websites now use HTTPS. According to the FTC, widespread website encryption means that ordinary public Wi-Fi usage is generally safer than it once was.

Nevertheless, outdated websites, poorly configured services, legacy protocols and some connected devices may still transmit information without adequate protection.

Browsing and connection information

Even when the contents of communications are encrypted, a network operator may still be able to observe limited metadata, depending on the protocols and privacy technologies being used.

This can include information such as:

• The device’s connection to the access point

• The time and duration of the connection

• The volume of data transferred

• Some network destinations or DNS requests, when these are not protected

This does not necessarily reveal the contents of emails, messages or HTTPS pages.

Session information

Advanced adversary-in-the-middle phishing systems may relay a victim’s interaction to a real service and attempt to capture authentication information or active session data.

This is not an automatic capability of every evil twin network. It generally requires an additional phishing or proxy system and a victim who interacts with the attacker-controlled page.

Two-factor authentication codes

Standard two-factor authentication improves account security, but a one-time code can still be stolen if a victim enters it into a sophisticated real-time phishing page.

The attacker may relay the password to the genuine service, ask the victim for the resulting code and use both immediately. Recent CISA guidance continues to document adversary-in-the-middle techniques capable of targeting passwords and some traditional two-factor authentication tokens.

Phishing-resistant authentication such as appropriately implemented FIDO/WebAuthn credentials is designed to reduce this risk because authentication is cryptographically connected to the legitimate website. NIST’s 2025 Digital Identity Guidelines require phishing-resistant options in higher-assurance authentication environments and encourage their use whenever practical.

How to protect yourself from evil twin attacks

Use cellular data for sensitive activities

Mobile data or a personal hotspot is generally preferable to unfamiliar public Wi-Fi, especially when accessing banking, workplace systems or confidential information.

The NSA recommends avoiding public Wi-Fi where possible and using a personal or corporate mobile hotspot with strong authentication and encryption.

Confirm the official network name

Ask an employee for:

• The exact Wi-Fi name

• Whether a password is required

• Whether a captive portal should appear

• What information the portal legitimately requests

Do not rely solely on printed material that could have been altered or on a network name displayed by your device.

Disable automatic Wi-Fi connections

Configure phones, tablets and laptops so that they do not automatically join open or remembered public networks.

The FTC specifically recommends stopping smartphones from connecting automatically to public Wi-Fi.

Forget public networks after using them

Remove public networks from the device’s saved-network list when they are no longer needed.

This reduces the possibility that the device will attempt to reconnect to another access point broadcasting the same name in the future.

Keep the operating system and browser updated

Security updates can improve certificate validation, browser protections, wireless security and resistance to known vulnerabilities.

The FTC recommends keeping security software, operating systems, browsers and mobile devices updated, preferably through automatic updates.

Use HTTPS but verify the domain

Look for HTTPS, but do not treat it as the only trust signal.

Confirm that the domain is correct before entering credentials or payment details. Open important services from their official applications or previously saved bookmarks.

Use a reputable VPN

Activate the VPN before performing sensitive activity on public Wi-Fi. For company devices, use the organisation’s approved VPN rather than installing an unknown free service.

The provider operating a VPN may be able to handle significant amounts of network data, so its reputation, business model, technical controls and privacy policy matter.

Use unique passwords

Each account should have a different password. A password manager can create and store strong, unique credentials.

If one password is stolen through a fake Wi-Fi portal, password reuse can turn one compromised account into several.

Enable multi-factor authentication

Multi-factor authentication provides an additional barrier when a password is exposed.

Where available, prefer phishing-resistant methods such as:

• Passkeys

• FIDO2 security keys

• WebAuthn authentication

• Appropriate certificate-based authentication

NIST’s current authentication guidance recognises cryptographic authentication methods that meet additional requirements as phishing-resistant.

Avoid entering sensitive information on unfamiliar portals

A Wi-Fi portal should not require credentials for unrelated services.

Never provide an email, workplace, banking or social media password simply to obtain internet access unless you have independently verified that the system is legitimate and authorised.

Turn off Wi-Fi when it is not needed

Disabling Wi-Fi reduces automatic connection attempts and limits exposure to nearby wireless networks.

The NSA recommends disabling Wi-Fi, Bluetooth and NFC when they are not in use.

How businesses can prevent evil twin attacks

Individual awareness is useful, but organisations should not rely entirely on employees spotting fake networks.

Publish one clearly defined network name

Tell employees and visitors:

• The precise SSID

• The expected authentication method

• Whether a captive portal is used

• What the portal will and will not request

• Where suspicious networks should be reported

Separate guest Wi-Fi from business systems

Guest access should be isolated from internal business networks.

The FTC advises businesses offering public or guest Wi-Fi to keep it separate from the primary business network.

Use WPA2 or WPA3 encryption

Business wireless networks should use appropriate authentication and encryption rather than obsolete protocols.

The FTC recommends WPA2 or WPA3 encryption for protected networks and identifies WPA3 as the newer option.

Encryption protects the legitimate network, but it does not by itself stop criminals from broadcasting a separate network with a similar name. User authentication and wireless monitoring remain important.

Deploy wireless monitoring

Organisations with significant wireless-security requirements can use wireless intrusion detection or prevention technologies to identify:

• Unauthorised access points

• SSIDs imitating corporate networks

• Abnormal wireless activity

• Devices operating outside established policies

The effectiveness of these systems depends on coverage, configuration, monitoring and response procedures.

Use certificate-based enterprise authentication

Properly configured enterprise Wi-Fi can authenticate users and the network using managed credentials and certificates.

Devices should be configured to validate the correct authentication server rather than accepting any server presenting a login request.

Manage devices centrally

Mobile-device management can help organisations:

• Preconfigure approved wireless networks

• Prevent connection to open networks

• Install trusted certificates

• Enforce VPN usage

• Remove unsafe profiles

• Require current operating-system versions

Train employees using specific examples

Training should show employees exactly what a fake SSID, fraudulent captive portal, certificate warning and suspicious reauthentication request might look like.

The FTC recommends regular staff training and updating employees as new risks and vulnerabilities are identified.

Adopt phishing-resistant authentication

Passwords and manually entered one-time codes can be captured by convincing phishing pages.

Phishing-resistant authentication reduces dependence on the employee correctly identifying every fraudulent page. NIST’s 2025 guidance recommends phishing-resistant authentication whenever practical and requires it in certain high-assurance federal use cases.

What should you do after connecting to a suspected evil twin?

Disconnect from the network immediately, but do not assume that disconnecting reverses anything already submitted.

1. Turn off Wi-Fi

Disable Wi-Fi and switch to a trusted cellular connection or known secure network.

2. Do not revisit the suspicious portal

Do not enter additional information or attempt to test the page.

3. Record useful details

Without reconnecting, note:

• The displayed network name

• The location

• The approximate time

• What the portal requested

• Which information you entered

• Any warnings displayed by the device

This information may help an employer, venue or security team investigate.

4. Change exposed passwords

From a trusted device and connection, change any password entered while connected to the suspected network.

Start with the associated email account because password-reset links for other services may be delivered there.

Replace reused passwords on every affected account with unique credentials.

5. Revoke active sessions

Use the account’s security settings to sign out other devices or terminate active sessions.

Changing a password does not always invalidate every existing session immediately.

6. Review multi-factor authentication

Check for:

• Newly registered authentication devices

• Unknown recovery telephone numbers

• New backup codes

• Changed recovery email addresses

• Unexpected security keys or passkeys

Remove anything you do not recognise.

7. Review account activity

Look for unfamiliar:

• Logins

• Messages

• Purchases

• Password resets

• Forwarding rules

• Application permissions

• File-sharing activity

• Profile changes

8. Scan and update the device

Install current operating-system and security updates. Run an approved security scan when appropriate, particularly if a file, profile, certificate or application was installed.

9. Notify the relevant organisation

Report the suspected network to:

• The venue

• Your employer’s security team

• Your IT administrator

• The impersonated service

• Relevant authorities when financial loss, identity theft or unauthorised account access has occurred

10. Monitor financial accounts

When payment information is entered, contact the card provider or financial institution using an official number. Review transactions and follow its fraud-response instructions.

Common myths about evil twin attacks

“Anyone on public Wi-Fi can read all my passwords”

Not necessarily.

When you connect directly to a legitimate website using properly implemented HTTPS, the Wi-Fi operator should not be able to read the encrypted password in transit.

The greater danger is being tricked into entering the password into a fake website or using an insecure service.

“A padlock means the website is genuine”

False.

A padlock means the connection to that domain is encrypted. A criminal can obtain HTTPS for a fraudulent domain, and the FTC explicitly warns that fake websites may also use encryption.

“A VPN makes every public network safe”

False.

A VPN protects traffic routed through its encrypted tunnel. It does not validate every website, stop users from submitting information to criminals or guarantee that a device is free of malware.

“Two-factor authentication always stops credential theft”

False.

Two-factor authentication is significantly better than relying on a password alone, but manually entered one-time codes can be captured through real-time phishing.

Phishing-resistant FIDO/WebAuthn authentication provides stronger protection against verifier impersonation.

“Only airports and cafés are targeted”

False.

An evil twin can be used anywhere people expect to find Wi-Fi, including:

• Hotels

• Conferences

• Universities

• Shopping centres

• Transport hubs

• Offices

• Apartment buildings

• Healthcare facilities

• Events and exhibitions

The attack relies on trust in the network name, not on a particular type of location.

An evil twin attack succeeds by exploiting familiarity and convenience. A network name looks correct, the signal is strong and the login page appears professional—so the user assumes the connection is safe.

Modern encryption limits what an attacker can passively extract from properly secured internet traffic. The central threat has therefore shifted towards deception: fraudulent portals, lookalike websites, unexpected authentication prompts and real-time credential phishing.

The most effective defence combines several layers:

• Verify network names

• Disable automatic Wi-Fi connections

• Prefer cellular data or a personal hotspot

• Use HTTPS and check the complete domain

• Run a trusted VPN on unfamiliar networks

• Use unique passwords

• Adopt phishing-resistant authentication

• Keep devices updated

• Stop immediately when a connection behaves unexpectedly

The crucial rule is simple: a familiar Wi-Fi name is not proof of a trusted network.