A visitor sits in your reception area, opens their laptop, and connects to a network named exactly like your guest Wi-Fi. It looks identical, behaves identically, and asks for nothing unusual. It is not yours. It belongs to whoever is sitting in the car park outside with a laptop of their own, patiently waiting for someone to connect.
How an evil twin actually works
An evil twin attack is disarmingly simple in concept, and it requires nothing more exotic than a laptop and some freely available software. An attacker sets up a wireless access point broadcasting the same network name as your legitimate Wi-Fi, often with a stronger signal than the real thing so devices prefer it automatically. Devices nearby, configured to automatically reconnect to familiar networks, or users manually choosing what looks like the right option from a list, connect to the fake network instead of the genuine one. From that point on, the attacker sits directly between the victim and the internet, watching everything that passes through their connection in real time.
This is not a theoretical exercise reserved for coffee shops and airports. It works just as effectively in your own reception area, meeting rooms, or car park, provided the signal reaches far enough to be picked up. Staff and visitors alike tend to trust a familiar network name without question, rarely stopping to verify anything beyond seeing the name they expect. A proper Wifi pen Testing tests exactly this scenario, checking whether your wireless environment gives an attacker room to impersonate you convincingly.
What actually gets captured
Once traffic is flowing through an attacker’s access point, the possibilities multiply quickly. Login credentials entered on unencrypted pages can be captured directly, in plain view, without any special decryption effort required. Even encrypted traffic can sometimes be manipulated into revealing information through clever prompts, fake certificate warnings, or captive portal pages designed to look exactly like your normal login screen, complete with your own logo lifted straight from the real site. The victim usually has no idea anything unusual has happened, because from their perspective, the internet simply worked as expected, exactly the way it always does.
William Fieldhouse has run this exact test in reception areas more times than clients might expect.
“We set up a rogue access point in a client’s lobby during a routine assessment, and within twenty minutes, three staff laptops had connected automatically without a single person noticing anything different”
— William Fieldhouse, Director of Aardwolf Security Ltd
Twenty minutes was enough. No phishing email, no suspicious attachment, nothing for a spam filter to catch. Just a stronger signal and a familiar name, sitting quietly in a space where nobody expected to be tested, let alone caught out so quickly.
Make your wireless estate part of your defence
Wireless security tends to get set up once at installation and rarely revisited, which is exactly why it deserves regular attention rather than being treated as a solved problem. Segment guest and staff networks properly, train people to notice unexpected certificate warnings, and test your physical premises the way an attacker actually would, rather than assuming distance alone offers protection. William puts it simply when clients ask why this matters, offering his own penetration testing quote as the way to find out what is really broadcasting around your building before somebody else takes advantage of it.