AP® Cybersecurity glossary
Evil twin
An adversary's access point that copies or imitates a legitimate network's service set identifier (SSID) so users join it by mistake.
Appears in the course and exam description (CED): 3.5.E.1
Why it matters in Unit 3
Users who join an evil twin send their traffic through the adversary. Detect it by scanning for similar SSIDs, then locate it by triangulation.
Example
An open network called School-WiFi appears next to the real, encrypted School-WiFi.
Learn it properly, with a checkpoint Wireless basics: access points, SSIDs and beacon frames