PHL-T-007

Category: rogue-ap
Severity: 7.5 / 10
Physical access: rf-range
Time to execute: 300 s
Skill level: 2 / 5
Hardware: ESP32 MarauderWiFi Pineapplelaptop with monitor-mode dongle
MITRE ATT&CK: T1557T1539T1566.002
MITRE D3FEND: D3-NTA

Observable indicators

Duplicate corporate SSID with BSSID outside the known AP MAC pool
Sudden DEAUTH frame burst against the legitimate AP (forcing client roam)
Client devices probe-requesting then associating to the BSSID outside expected channels
Captive-portal-style HTTP 302 to an attacker-controlled host

Evil twin rogue AP

The attacker broadcasts an SSID identical to the corporate WiFi at higher signal strength (or after deauthenticating clients from the legitimate AP) and serves a captive portal that mimics the company SSO. Victims enter credentials, which the attacker forwards to the real IdP or simply harvests.

Attack chain

Attacker arrives within RF range of the target premises.
Optionally deauths clients off the legitimate AP using aireplay-ng or Marauder.
Brings up a hostapd AP with the same SSID and a captive portal cloning the corp login.
Victims connect; credentials are captured. Optional: attacker proxies real auth so victim sees normal behavior.

Why it matters

Even SSO + MFA does not fully neutralize this if the captive portal also harvests the TOTP / push approval in real time (attacker-in-the-middle pattern, also known as Evilginx-style for web SSO).

Defensive layers

Detection: PHL-D-007 (duplicate SSID with foreign BSSID), PHL-D-009 (deauth burst), PHL-D-010 (client SSID probe to corp name from outside expected client pool).
Prevent: enterprise WPA2/3 with EAP-TLS (mutual cert auth, no password to phish); phishing-resistant MFA (WebAuthn/FIDO2); disable WPA2-PSK SSIDs for staff.
Respond: alert on duplicate BSSID via Kismet or APs in wireless IDS mode; rotate any credentials observed authenticating on the rogue AP; geographically locate via signal triangulation.