Fake public Wi-Fi: how the evil twin attack steals your passwords

You're at the airport, flight delayed, battery in the red. You see the "AirportFree" network available — the same one you use in that terminal every time — and you connect without thinking. Thirty metres away, someone with a laptop and a device the size of a router is watching every request that leaves your phone. That's an evil twin attack: simple to set up, invisible to the victim and devastating if you're logging into anything.

What the evil twin attack is

An evil twin is a fake Wi-Fi network that impersonates a legitimate one point for point. The attacker copies the exact name (SSID) of the original network and broadcasts the same identifier, often with a stronger signal to attract nearby devices. From your phone's or laptop's point of view, it's impossible to tell the two apart: both show up with the same name, and the Wi-Fi protocol (802.11) requires no certificate of authenticity from the access point.

It's a man-in-the-middle attack by design: all the victim's traffic passes through the attacker's equipment before it reaches the real internet. Anything unencrypted, they see in plain text. Anything encrypted with HTTPS, they can try to force down to HTTP using downgrade tools — or simply log for later analysis.

How the attack works in practice

The basic setup needs three things: a Wi-Fi interface that supports AP (access point) mode, software to broadcast the fake SSID — tools like Hostapd, or dedicated hardware like the Wi-Fi Pineapple — and an outbound connection (the attacker's own phone tethering over 4G is enough).

The typical flow:

1. Reconnaissance: the attacker scans the environment, notes the legitimate network's SSID and the channel it operates on.
2. Clone: they bring up an access point with the same SSID. They may use the same channel to cause confusion, or an adjacent channel with a stronger signal.
3. Forced deauthentication (optional, but common): they send deauthentication packets (unauthenticated 802.11 frames, because the original standard didn't require signing) to knock devices off the legitimate network. On reconnecting, the victim's device picks the strongest signal — the fake one.
4. Fake captive portal: many public networks show an "accept the terms" page before granting access. The attacker clones that page and uses it to capture credentials — sometimes an email password or a store account, under the pretext of "sign in with your profile".
5. Traffic interception: with the victim connected, the attacker monitors in real time: session cookies, forms without HTTPS, DNS queries, HTTP headers.

What the attacker can capture

It depends on what you do while connected. In the worst case:

• Credentials on sites without HTTPS (they still exist, especially older public-service portals and IP cameras).
• Session cookies on sites that separate authentication (HTTPS) from browsing (HTTP) — this allows session hijacking without ever knowing the password.
• Unencrypted DNS queries: these reveal which domains you visit even without showing the content. If you use DNS over HTTPS, that vector is blocked — something we explain in the post on NextDNS and encrypted DNS.
• Fake captive portal credentials: email, ID number, password — whatever you type to "get on the network".
• Mobile app traffic that doesn't pin certificates: some older applications still transmit sensitive data without properly validating the server's certificate.

How do I know if I'm connected to a fake Wi-Fi?

Can you detect an evil twin in real time?

In practice, no — not reliably, not as a non-technical user. The SSID is identical to the legitimate one, the signal may be stronger, and internet access works normally (the traffic just passes through the attacker in the middle). A few circumstantial clues:

• The captive portal asks for more than usual — an email password, an ID number or bank details are immediate red flags. Legitimate portals ask you to accept terms, at most a contact email.
• The portal's HTTPS certificate expires today or is self-signed — the browser shows a warning. Never ignore certificate warnings on public networks.
• You were abruptly disconnected from the network you were already using and reconnected without picking it manually — that can be a sign of a deauth attack.
• The gateway's MAC address (checkable with arp -a or apps like Network Analyzer) has changed since your last visit.

But those clues demand active attention. Real protection is preventive, not reactive.

How to protect yourself from an evil twin attack

Always use a VPN on public networks. It's the most effective protection: even if you land on an evil twin, all traffic leaves your device encrypted before it reaches the fake access point. The attacker sees ciphered bytes, not your data. Cloudflare WARP (free), Mullvad and ProtonVPN are solid options.

Turn off automatic reconnection to open networks. On Android: Settings → Wi-Fi → Network preferences → uncheck "Connect automatically". On iOS: tap the (i) icon next to the saved network and turn off "Auto-Join". Without that adjustment, your device connects to the clone on its own and you never notice.

Prefer your phone's hotspot. Mobile data costs money, but it doesn't come with an attacker in the middle. For remote work at an airport or hotel, sharing your phone's 4G/5G connection is the safer default — and what real OPSEC teams recommend.

Confirm the SSID with the venue's staff. It sounds basic, but it works: before connecting to "Mall_WiFi", ask an employee what the network is actually called. Attackers rarely know the specific internal name the venue uses.

Force HTTPS everywhere. Use the HTTPS Everywhere extension (available for Chrome and Firefox) or turn on your browser's built-in HTTPS-only mode. Sites with properly implemented HTTPS and HSTS resist interception even on compromised networks.

Don't ignore certificate warnings. If the browser warns you that a site's certificate is invalid while you're on a public network, disconnect immediately. That's a clear sign someone is trying to intercept the communication.

What about at home — should I worry?

On home networks the evil twin risk is much lower — the attacker would need to be within physical range of your router. But the logic still applies: badly configured routers running the factory default SSID are easier to clone, because the attacker already knows the name. Customising the SSID, disabling WPS and configuring the router properly are steps we cover in the guide to home Wi-Fi router hardening.

Conclusion

The evil twin is one of the cheapest and quietest attacks on public networks. It requires no software vulnerability, sets off no antivirus, and the victim browses normally until they realise — too late — that their credentials have been captured. The defence isn't detecting the attack in real time, because that's nearly impossible without specialised tools. The defence is making the traffic useless to the attacker: VPN on, HTTPS enforced, automatic reconnection off. If you want to go deeper on the privacy layer beyond Wi-Fi, the guide to OPSEC and digital privacy covers the next steps.