Evil Twin Attacks: How Fake WiFi Networks Work and How to Spot Them

An Evil Twin is an access point that broadcasts exactly the same network name (SSID) as a legitimate one — for example “Hotel_Guest” or “Company_WiFi” — to lure users into connecting.

A typical attack

1. The attacker sets up a fake AP with the same SSID and a stronger signal.
2. They send deauthentication frames to disconnect users from the real AP.
3. Victim devices automatically reconnect to the fake AP.
4. The attacker shows a fake login page or intercepts traffic.

Warning signs

• Two APs with the same SSID but a different BSSID or vendor.
• A sudden spike in deauthentication frames.
• Unexpected requests to log in again.

WiFi Tracer automatically matches your list of legitimate BSSIDs and raises an alert as soon as a “twin” appears, while locating the fake device on your floor plan.