An evil twin attack is a rogue Wi-Fi hotspot that impersonates a legitimate network — same network name, often a stronger signal — to capture the traffic of everyone who connects to it. Staff think they joined the cafe, airport or hotel network; they joined a laptop six metres away. This guide explains how evil twin attacks work in 2026, what one costs a business, and the connection habits that make them pointless.
TL;DR
- An evil twin attack is a fake Wi-Fi hotspot cloned from the name of a real network.
- It works wherever free Wi-Fi is trusted blindly: cafes, airports, hotels, and conference venues.
- Attackers harvest credentials on fake login pages and intercept anything the user sends unencrypted.
- HTTPS, MFA and a connect-or-refuse habit close most of the attack; device hygiene covers the rest.
- Cyber Aware's security awareness training rehearses that decision before staff face it in the wild.
What an evil twin attack is
An evil twin is a wireless access point under the attacker's control, configured to look exactly like a network people expect to find. The technique copies three things at once:
- The network name (SSID). The attacker clones the SSID of the real hotspot nearby, or names their device after a generic network such as Airport_Free_WiFi.
- The login experience. Many public networks open a captive portal before granting access. The evil twin presents its own convincing copy of that portal — where staff type the credentials that grant the attacker access to other services, since password reuse does the rest.
- The routing. Every request from the victim's device flows through the attacker's machine first. They sit between the user and the internet — the position that defines a man in the middle attack.
The equipment is trivial. Any laptop or phone with hotspot software can run the attack, and portable rigs make it viable in an airport lounge or a conference hall. No exploit, no zero day: the attacker only needs people who connect to the strongest network with the familiar name.
How an evil twin attack unfolds
- Reconnaissance. The attacker sits in a location staff from target industries frequent — a business district cafe, a hotel lobby during an industry event — and lists the network names visible.
- The clone. They broadcast an evil twin of a popular network, often with a stronger signal, so devices auto-connect or users pick the first option in the list.
- The interception. Connected traffic routes through the attacker. Cleartext or weakly protected traffic — older sites, misconfigured apps — can be read or modified directly.
- The harvest. Fake captive portals, fake login prompts or injected content capture credentials. A page asking staff to "log in again" can hand over their email password in seconds.
- The payload. On machines with outdated software, the attacker can serve a fake software update or poisoned download — planting an infostealer whose stolen session cookies enable session hijacking later, from anywhere.
The attack ends when the attacker walks away — which is part of what makes it hard to attribute. The victim connects, works, leaves, and never sees the machine that watched the whole session.
What an evil twin costs a business
A successful evil twin session yields the same assets as any account takeover: email credentials, banking sessions, customer data, and the trust those accounts carry. From a stolen mailbox the next steps are familiar — fake invoices to customers, payroll changes, further phishing from a trusted internal address.
The Australian baseline puts numbers on it. The Australian Signals Directorate received more than 84,700 cybercrime reports in 2024-25 — one every six minutes — and the average self-reported cost of a cybercrime incident for a small business rose 14 per cent to $56,600 (ASD Annual Cyber Threat Report 2024-25). Remote work makes that exposure portable: every laptop working from a public space carries the attack surface with it.
Evil twin vs other Wi-Fi attacks
| Attack | How it works | What the victim notices |
|---|---|---|
| Evil twin | Fake hotspot cloned from a real network's name | Nothing — everything looks normal |
| Man in the middle on an open network | Passive sniffing of unencrypted traffic on a shared network | Nothing, until accounts are compromised |
| Karma / hotspot baiting | Device answers every probe for a remembered network | The phone connects "back" to a network it knows |
| Wi-Fi jamming plus fake portal | Real network jammed, fake one presented as the fix | The Wi-Fi seems down; the "fix" is the attack |
The baiting variants matter because they defeat the habit of joining only remembered networks: the device asks for a name it trusts and the attacker answers.
How to spot an evil twin
- Two networks with the same name. A legitimate hotspot does not duplicate itself. When the same SSID appears twice, treat the second one as hostile.
- A login page where there never was one. A captive portal demanding an email password at a cafe that normally just connects is the classic tell.
- Certificate warnings. A browser security warning about a website certificate means someone may be intercepting the connection. Never click through it to check email or banking.
- Sluggish, broken browsing. Requests failing, mixed results, or sites refusing to load can mean traffic is being tampered with.
- The rogue device itself. On a managed network, an access point nobody installed is an incident — report it, do not reboot around it.
None of these is proof on its own, but any one of them is a reason to stop what you are doing on that connection.
How to protect your business and staff
- Set the reflex before the trip. The decision that matters is made in the three seconds before connecting: is this network expected, verified and worth it? Monthly security awareness training rehearses the habit — including refusing free Wi-Fi entirely and using a phone hotspot instead.
- Mandate VPN or zero-trust access for sensitive work. Encrypted tunnels make intercepted traffic unreadable, which strips the evil twin of most of its value.
- Turn off auto-connect and forget public networks after use. A device that stops announcing remembered network names is immune to baiting variants.
- Keep MFA on everything, and prefer app or hardware-key factors. A password typed into a fake portal is worth far less when the attacker still cannot complete the login.
- Patch devices. The download-injection step of an evil twin attack only works on unpatched software.
- For remote and travelling staff, make it policy, not advice. A written rule — no sensitive work on open public Wi-Fi — gives managers something to enforce and staff something to cite.
Why this matters for Australian businesses
The controls above overlap almost completely with the frameworks small businesses already report against. Essential 8, SMB1001 and most cyber insurance questionnaires expect MFA, patching and staff awareness evidence, and the evil twin's two steps — the connect decision and the credential harvest — are exactly what those controls test. A cyber security gap assessment shows which of them are actually in place across the business, rather than on the machines someone remembers.
FAQ
What is an evil twin attack in simple terms? Someone sets up a fake Wi-Fi hotspot using the name of a real network. Staff connect expecting the cafe or airport network, and everything they do online passes through the attacker's device first.
Is HTTPS enough protection on a fake Wi-Fi network? HTTPS encrypts the content of requests to properly configured sites, which is why modern banking and email resist passive reading. It does not stop credential capture on injected fake pages, session theft or delivery of malicious downloads — HTTPS narrows the attack, it does not close it.
How is an evil twin different from a man in the middle attack? The evil twin is the fake hotspot; the man in the middle is the interception position it creates. Every evil twin attack is a man in the middle attack delivered over Wi-Fi.
What should I do if I connected to a fake network? Disconnect immediately, switch to mobile data, then treat every login used during that session as compromised: change passwords from a clean network and review account activity and mailbox rules. Report it to IT so other staff can be warned.
Are evil twin attacks common? Uncommon as a headline breach, common as a technique — targeted campaigns use them against travellers and executives precisely because they leave no malware trail. The defence costs almost nothing, which is why it belongs in every training program.
Does a VPN stop evil twin attacks? A reputable VPN encrypts the tunnel, so the attacker sees unreadable traffic instead of sessions and credentials. It does not stop a fake captive portal from harvesting a password before the VPN connects — the connect-or-refuse habit still matters.
One last thing
Ask your team one question this week: what do you do when the airport or cafe network asks you to log in? The staff answer that keeps the business safe is a boring one — never type a password into a portal you were not expecting, and use your phone's hotspot when in doubt. That single habit costs nothing and removes the entire attack.
Related guides
- What is a man in the middle attack? — the interception technique the evil twin enables.
- What is session hijacking? — why a stolen session beats a stolen password.
- Human risk reporting — measure who reports and who clicks, per person.