What an evil twin actually is
It is one of the few Wi-Fi attacks that still works well in 2026, and it is far less dramatic than the name suggests. Understanding it makes it obvious why detection has to happen at the access point layer.
Updated 21 August 2026
The attack in one paragraph
Your devices remember networks by name. Once your laptop has joined Home-5G, it will look for Home-5G again and, in many configurations, join automatically. An evil twin is simply another access point broadcasting that same name. If its signal is stronger — because it is closer to you than your real router — your device may prefer it. You are now on someone else’s hardware, and all your traffic routes through them.
What it can and cannot do
This is where most coverage overstates things. Once you are on an attacker’s access point, they control routing and DNS. They can see which hosts you connect to, block things, and try to push you toward pages they control.
What they generally cannot do is read the contents of your HTTPS traffic. Modern web traffic is encrypted end to end, and certificate validation means an attacker cannot silently impersonate a site without a certificate your device trusts. Browsers show loud warnings when that fails. The realistic risks are metadata exposure, DNS manipulation, captive portal phishing, and attacks on anything still using unencrypted protocols.
Which is why Airward does not claim to “stop eavesdroppers”. There is nothing to stop at the encryption layer — that job is already done. The useful thing software can do is notice the impersonation and tell you before you trust the network.
Why it is hard to notice
Nothing looks wrong. The network name is right, because the name is the thing being copied. The connection works, because the attacker wants it to. Your device does not warn you, because from its point of view a network with the correct name is exactly what it was looking for.
The only reliable tell is at a layer you cannot see without looking: the BSSID, the hardware address of the access point itself. Your network’s name can be copied in seconds. An access point broadcasting your SSID from a BSSID you have never seen before is the signal worth acting on.
Why legitimate networks make this noisy
Any mesh system, office network or café with more than one access point broadcasts the same SSID from many BSSIDs — that is how roaming works. A naïve detector fires an alert per access point and becomes useless on the first day.
The workable approach is a baseline. Record the access points serving a network the first time you see it, treat those as normal, and alert only on ones appearing afterwards — because an attacker’s access point, by definition, arrives after you already knew the network.
What actually helps
- Turn off auto-join for public networks. The attack depends on your device choosing for you.
- Watch for security downgrades. A clone of a WPA2 network that is suddenly open is a strong signal — legitimate networks rarely get less secure.
- Know your access points. Not by name — by BSSID. Software is better at remembering these than you are.
- Use a VPN on networks you do not control, which limits what routing control is worth to an attacker.
Airward Pro does the BSSID bookkeeping — baseline on first sight, alert on what appears after, and flag it as higher severity when the new access point offers weaker security than the one you are actually on. Tools that survey the RF environment show you the same airwaves for a different purpose.