What is an evil twin?
An evil twin is an attacker's wireless access point that copies a legitimate network's name, its SSID, so users connect to it by mistake. Once a device associates with the evil twin, the attacker is on-path for everything that device sends, able to read, record or alter traffic and to harvest anything typed into cleartext or convincingly faked pages. It does not need to touch the real company network at all; it sits in a lobby, parking lot or coffee shop, sometimes with a stronger signal than the network it imitates.
How it works
The attacker broadcasts the target SSID from their own hardware. To speed things up, they may send deauthentication frames to knock clients off the real access point so the devices reconnect, and some reconnect to the stronger evil twin automatically. The evil twin often presents a captive portal that asks for the network password or a login, which hands the attacker credentials directly. Because many devices remember and auto-join networks by name, a user may never notice the switch.
How to spot it
An evil twin usually gives itself away by its security settings. It may use open authentication where the real network uses WPA2 or WPA3-Enterprise, or it may prompt for a certificate or password when the genuine network connects silently. A wireless intrusion prevention system (WIPS) compares what it hears against an inventory of approved access points by BSSID, channel and security, and flags an unknown radio broadcasting a known SSID.
How to defend against it
Use enterprise Wi-Fi with 802.1X and configure clients to validate the authentication server's certificate, so a device will not complete a login to a fake network. Deploy a WIPS to detect rogue radios and deauthentication floods, and enable Protected Management Frames to blunt the deauth trick. On untrusted networks, a VPN protects traffic even if a user connects to the wrong access point, and users should be trained not to join open networks that imitate a known name.
Evil twin vs. rogue access point
A rogue access point is any unauthorized access point connected to the organization's own network, often one an employee plugged in for convenience, which opens an unmanaged path onto the internal network. An evil twin is an attacker's access point that imitates a legitimate SSID to lure users, and it need not be attached to the company network at all. If the device copies the network name to trick users, it is an evil twin.
Evil twin on the CompTIA Security+ exam
Evil twin is taught as an on-path network attack under objective 2.5, and under objective 2.4 it is the attack contrasted with the rogue access point, a vulnerability type in that objective. Scenario wording about a duplicate SSID, users connecting to a fake hotspot, or a captive portal asking for the Wi-Fi password points at it; the distractor is a rogue access point attached to the wired network. It also appears on A+ Core 2 (220-1202) objective 2.5 among social engineering attacks, threats and vulnerabilities.