Evil twin hotspots

Devices remember networks they have joined, and they rejoin them automatically by name. An evil twin exploits that: an attacker broadcasts a network with the same name as one your device trusts, your device connects without asking, and the attacker is now the network.

The technique is old and still works, because the underlying behaviour — automatic reconnection by name — is a feature nobody wants to remove.

What the attacker gains

Position. They control DNS, routing and what happens to anything unencrypted, and they can observe the shape of everything else.

Concretely:

• Every DNS lookup, which is a list of the sites you visit.
• Every hostname in a TLS handshake, for the same reason.
• Anything unencrypted, which is now a small category but not empty.
• The ability to interfere: block, redirect, delay, or present a captive portal that looks like anything they choose.

What they do not gain

Your encrypted traffic. TLS is authenticated by certificates. An attacker without a valid certificate for a site cannot impersonate it without producing a browser warning, and HSTS makes many of those warnings unskippable.

Session hijacking of the classic kind. That required unencrypted sessions, which mostly no longer exist.

Your Wi-Fi password, on WPA2 or WPA3 networks — though a twin of an open network needs no password at all, which is why open networks are the usual target.

The realistic attack in 2026

Not decryption. Deception.

A convincing captive portal asking you to sign in with an email or social account. A page claiming a certificate error and asking you to install a profile. A software update prompt. All of these work on people rather than on protocols, and none of them requires breaking anything cryptographic.

That is where the actual risk sits, and it is why the practical advice is about what you type rather than about what your device negotiates.

What a VPN does about it

A tunnel removes the observation entirely. The twin sees one encrypted stream to one address: no DNS, no hostnames, no destination list. Everything in the "what they gain" list above disappears except the ability to block or delay.

It does not protect the portal step, because the portal precedes the tunnel. And it does not stop you typing a password into a convincing fake page.

So: strong against surveillance, no help against deception.

Practical defences

Turn off automatic joining for open networks. Both iOS and Android have this, and it removes the automatic part of the attack.

Forget networks you no longer use. A device that remembers a hotel network from three years ago will rejoin a twin of it.

Prefer mobile data or a personal hotspot where it is available. Simpler than any of this.

Never enter account credentials into a captive portal. No legitimate network needs your email password.

Never install a certificate or profile that a network asks for. This is the one action that genuinely defeats TLS, and it requires your cooperation.

Use WPA3 networks where offered. It protects against several attacks including offline password cracking on the network itself.

If you suspect one

Disconnect, use mobile data, and check whether anything you did on that network involved credentials. Then, on a trusted connection, verify what your device thinks is happening — what is my IP and the DNS leak test together will show whether traffic and lookups are going where you expect, which is the useful thing to confirm before trusting the device again.

Why the attack persists despite better encryption

Because the mechanism it exploits is not a flaw. Devices rejoin known networks automatically so that your phone connects to your home Wi-Fi when you walk in the door, and network names are not authenticated on open networks because there is no key to authenticate them with.

WPA3's protections apply to networks with a password, and its Enhanced Open mode provides unauthenticated encryption for open networks — which stops passive eavesdropping and still does not prove the access point is the one you meant.

So the underlying condition is likely to persist, and what changed is how much an attacker gains from the position rather than whether they can take it.

The corporate variant

On enterprise networks using WPA2-Enterprise or WPA3-Enterprise, devices authenticate the network with a certificate. A twin cannot present a valid one, and a correctly configured client refuses to connect.

That configuration is the real defence, and it is frequently undermined by devices set to accept any certificate for convenience during rollout. If you manage a fleet, that setting is worth auditing — it converts a solved problem back into an open one.

What to do afterwards

If credentials were entered on a suspect network, change them from a trusted connection and check for unfamiliar sessions on the affected accounts. That is proportionate and sufficient; wiping a device is not usually warranted for an observation-position attack.