Definition
An Evil Twin Attack is a wireless attack where a threat actor sets up a fraudulent Wi-Fi access point with the same SSID as a legitimate network to trick users into connecting and intercept their traffic.
People Also Ask
Common questions about Evil Twin Attack answered by our security experts.
Evil Twin Attack in Practice
An evil twin is a rogue wireless access point impersonating a legitimate network. Devices connect to it believing it is the familiar network, and the operator is then positioned between them and everything they reach.
It requires inexpensive equipment and no privileged access, which makes it one of the more accessible ways to obtain a man-in-the-middle position.
Why devices connect to it
Saved networks are rejoined automatically by name, and most devices do not verify that the access point is the same physical equipment as before. A stronger signal with a familiar name is preferred.
Attackers also force disconnection from the legitimate network so devices reconnect, and to the stronger nearby option. The user sees a brief interruption and nothing else.
The corporate network variant
An access point advertising your corporate network name, with a captive portal or a prompt requesting domain credentials, harvests them directly. Staff enter them because the request appears to come from their own network.
This is why client-side certificate validation matters in enterprise wireless: a device configured to verify the authentication server's certificate will not present credentials to an impostor. It is a client setting, it is frequently disabled during troubleshooting, and disabling it undermines the entire mechanism.
Public network impersonation
Open networks in hotels, airports and cafes are trivially impersonated, since there is no authentication to replicate and users expect a portal.
The practical defence for staff is not avoiding these networks but assuming they are hostile: a VPN or zero trust access for corporate traffic, and encryption that is verified rather than assumed.
Certificate-based authentication removes the target
Where wireless authentication uses client certificates rather than passwords, there is no credential to harvest. That is the structural answer for a corporate network and it is achievable wherever device management can distribute certificates.
It also removes the shared-password problem, where a departing employee retains a network key that would otherwise need changing across every device.
Detection on your own premises
Wireless intrusion detection identifies access points advertising your network names from unexpected hardware, and most enterprise wireless infrastructure includes this capability unused.
Periodic surveys find rogue equipment, including well-intentioned consumer access points staff have connected to provide coverage — which are a related and more common problem.
Testing for it, and what a survey finds
A wireless assessment that includes impersonation is inexpensive and consistently productive. Typical findings: clients configured without server validation, saved open networks that rejoin silently, and staff willing to enter credentials into a captive portal on a network name they recognise.
Surveys also find rogue equipment installed with good intentions — a consumer access point added to fix a coverage complaint, bridging an unsecured network into the corporate one. That is a more common problem than a deliberate attacker and it has the same effect.
Where to start
Check whether your managed devices are configured to validate the wireless authentication server's certificate. Where they are not, harvesting domain credentials requires only a laptop in your car park.
See wireless security. GuardsArm runs wireless penetration testing.
Related Terms
Man-in-the-Middle Attack
A Man-in-the-Middle (MitM) attack is a cyberattack where an attacker secretly intercepts and potentially alters communications between two parties who believe they are communicating directly with each other.
Wireless Security
Wireless Security encompasses the measures and protocols used to protect wireless networks and connected devices from unauthorized access, eavesdropping, and attacks that exploit vulnerabilities in Wi-Fi and other wireless technologies.
Phishing
Phishing is a social engineering attack where cybercriminals send fraudulent communications, typically emails, that appear to come from a trusted source. The goal is to trick recipients into revealing sensitive information, clicking malicious links, or downloading malware.
Related Reading
Secure Hospital Wi-Fi: Separating Guest Access From Clinical Systems
One SSID for patients, one for staff, one for devices that cannot do modern authentication — and none of them able to reach each other. Practical…
The $4.5 Million Email: How Phishing Still Owns Healthcare
Phishing remains healthcare's most expensive attack vector, not because staff are careless but because the attacks are sophisticated and the…
MFA Won't Save You: Why Token Theft Is Healthcare's Next Crisis
Attackers don't need your password anymore. They're stealing session tokens after MFA approval, and healthcare organizations running Microsoft 365…
Speak With an Expert
Book a free consultation to discuss evil twin attack for your organization.
Related Services
Need Help With Evil Twin Attack?
Our certified security professionals can help you implement the right evil twin attack strategy for your organization. Get a free assessment today.
Book a Free Consultation