An Evil Twin is a rogue Wi-Fi access point that copies the name, login flow, or appearance of a legitimate network so nearby devices connect to it by mistake. Once a victim joins, the attacker can observe traffic, redirect web requests, or deliver malicious pages such as fake update prompts. The goal is not only to steal data, but to place the attacker in the middle of the user’s trust path.
This matters because Wi-Fi names are easy to imitate and many devices auto-connect to familiar SSIDs. Evil Twin setups are often used in phishing, credential capture, captive-portal abuse, and on-path manipulation. Defenses include disabling auto-join on untrusted networks, verifying the network before connecting, using VPNs on public Wi-Fi, and monitoring for duplicate SSIDs, unexpected portal redirection, and rogue access point activity.