WPA3 was designed to improve wireless security, but when misconfigured, it can still leave networks open to attack. During a recent assessment, RedLegg discovered that several client networks using WPA3 Personal transition mode were vulnerable to a classic evil twin attack. This backwards compatibility setting, while useful for legacy devices, introduced the risk of a downgrade attack that exposed the network passphrase.
WPA3 improved wireless encryption significantly over its predecessor, but encryption is only half the equation. During a recent wireless assessment, our team found something worth documenting: several client networks running WPA3 Personal transition mode were still vulnerable to a WPA3 evil twin attack through a protocol downgrade method that exposed the network passphrase. The protocol secured the connection. It had no way to verify that the network was worth trusting in the first place.
This post breaks down how evil twin attacks work, why WPA3 doesn't fully prevent them, what our team found in the field, and what organizations can do to reduce real-world wireless risk.
A WPA3 evil twin attack is a wireless attack in which an adversary creates a rogue access point that mimics a legitimate Wi-Fi network. Once a device connects to the fake network, the attacker can intercept traffic, capture credentials, or launch further attacks, regardless of whether WPA3 encryption is in use on the original network.
The critical nuance: WPA3 encrypts the traffic between a device and a legitimate access point. It does not verify network authenticity. Devices cannot independently confirm they are connecting to the real network rather than an imposter broadcasting the same SSID. That gap is what evil twin attacks exploit.
WPA3 is the latest wireless security protocol developed by the Wi-Fi Alliance, designed to address documented weaknesses in WPA2 and provide stronger protection for wireless communication.
The biggest change WPA3 introduced is the Dragonfly handshake, officially known as Simultaneous Authentication of Equals (SAE). This replaces the Pre-Shared Key (PSK) handshake used in WPA2.
In WPA2, authentication relies on a four-way handshake that proves both the client and the access point know the shared password. An attacker who captures that connection request can attempt to guess the password offline, with no further interaction with the network. The Dragonfly handshake closes that window by requiring live interaction with the target access point for each guess, making brute-force attacks substantially slower and less viable.
SAE also introduces forward secrecy, generating a unique session key each time so that captured credentials cannot be used to decrypt previous traffic. Both the client and the access point contribute equally to the key exchange, which strengthens the handshake even when weaker passwords are in use.
WPA3 is a meaningful improvement. The problem is that improvement is conditional on how it is deployed. Many organizations enable transition mode deliberately, to keep older devices connected while hardware is phased out over time. That tradeoff is common, and often reasonable on its own. It's also exactly the gap the next section covers.
An evil twin attack works in five stages: the attacker creates a rogue access point broadcasting a familiar network name, tricks nearby devices into connecting, and positions themselves between the victim and the internet. From there, they can intercept traffic, capture credentials, and, in WPA3 transition-mode environments, downgrade the connection to WPA2 to capture a handshake that can be cracked offline.
Understanding the attack sequence clarifies why encryption alone is insufficient as a defense.
1. Rogue access point creation: The attacker sets up a fake wireless access point and configures it to broadcast the same SSID as the target network. Tools like eaphammer automate this process and allow the attacker to configure the rogue AP to accept WPA2 PSK authentication rather than WPA3 SAE, a key step in a downgrade attack.
2. SSID spoofing: The rogue AP broadcasts the same network name as the legitimate one. Nearby devices (particularly those configured to auto-connect to known networks) scan for familiar SSIDs and may initiate a connection to the strongest available signal, which the attacker can manipulate.
3. Client connection through social engineering or signal strength: Devices do not verify which access point is legitimate. They connect to whichever AP responds with a recognized network name, often the one with the strongest signal. Attackers can use deauthentication frames to disconnect clients from the legitimate AP and push them toward the rogue one.
4. Traffic interception: Once connected to the rogue AP, the device routes traffic through the attacker's system. The attacker is positioned between the client and the internet, a classic man-in-the-middle Wi-Fi attack posture, with visibility into unencrypted traffic, DNS queries, and session data.
5. Credential capture and handshake cracking: In downgrade scenarios where WPA3 transition mode is enabled, the rogue AP accepts WPA2 PSK authentication. When the client authenticates using WPA2, the attacker captures the four-way handshake and can attempt to crack it offline using tools like hashcat.
This is the most important point on the page, and it is frequently misunderstood. In practice, security teams often treat a WPA3 upgrade as closing the rogue access point conversation entirely. It doesn't: WPA3 hardens the handshake, not the trust decision a device makes about which network to join.
WPA3 encrypts the communication between a client and a legitimate access point. It does not authenticate the network itself to the client. There is no built-in mechanism in WPA3 Personal that prevents a device from connecting to a rogue AP broadcasting a familiar SSID.
The SSID is not integrated into the Pairwise Master Key (PMK) derivation in WPA3 Personal mode. A device cannot verify that the access point it is connecting to is the one it previously trusted. Until the organization deploys SSID protection or certificate-based authentication, devices operating on WPA3 Personal can still fall prey to rogue access point attacks.
The situation is compounded by transition mode. Many organizations enable WPA3 Personal transition mode to maintain backward compatibility with older devices that do not support WPA3. Transition mode allows WPA2 PSK connections alongside WPA3 SAE connections on the same access point. Attackers exploit this by presenting a rogue AP that only offers WPA2. Devices configured to auto-connect accept it, downgrade to WPA2, and expose themselves to handshake capture.
Researchers Mathy Vanhoef and the TrustedSec team have documented these downgrade scenarios in detail. The academic literature is consistent on the point: transition mode introduces the highest practical risk of wireless credential compromise. Protocol improvements narrow the technical path, but the outcome still depends heavily on how users respond to certificate warnings, login prompts, and unfamiliar disconnects. A peer-reviewed paper published in the I.J. Wireless and Microwave Technologies in 2025 confirmed that evil twin attacks using captive portal and downgrade methods remain effective against WPA3 networks, including those not running transition mode, by exploiting weaknesses in user behavior rather than protocol cryptography.
During a recent wireless assessment, our team tested networks at multiple physical locations for a client. Most networks were running WPA3 Personal (WPA3 SAE). As part of the engagement, the client provided the network passphrase for testing purposes. The objective was to determine what an outside attacker (without that passphrase) could realistically accomplish.
Using a Kali virtual machine and an external wireless card, our team used airodump-ng, part of the aircrack-ng suite, to enumerate the target networks across multiple channels.
An example of this can be observed in the image below:
To confirm whether transition mode was active, we used tshark to examine packet capture files with the following command:
tshark -r target.cap -Y "wlan.fc.type_subtype == 8" -V | grep -i 'auth key management'
The output confirmed that both SAE and WPA2-PSK authentication were accepted, indicating that transition mode was enabled across all tested locations.
Although WPA3 is more secure than previous protocols, there are multiple concerns surrounding the configuration and implementation in an environment. WPA3 can present multiple challenges with older, smaller, and less powerful devices, as well as complex security parameters.
For devices that do not support WPA3, the backwards compatibility transition mode must be enabled to allow them to connect to access points using WPA2 connections. This security downgrade can result in handshakes being captured and cracked offline.
WPA3 also entails an increase in resource usage, which can affect the performance of the connection or shorten battery life. Aside from those issues, the security parameters for implementation are often non-intuitive and complex. Default settings, permissions, and protection mechanisms need to be regularly reviewed and tested.
There are also attacks collectively known as “Dragonblood,” which primarily focus on side-channel vulnerabilities. These can result in data leakage, forcing connections to be downgraded to WPA2, and cause denial of service conditions.
The most frequently seen attacks take aim at the transition settings used for compatibility. By exploiting the ability to downgrade the security protocol, an attacker has the highest likelihood of capturing a password that can be cracked to gain access to the wireless network.
To highlight these weaknesses and demonstrate this attack vector, RedLegg used the tool eaphammer to create an evil twin access point, a fake wireless network that has the same name as the legitimate target network.
This evil twin access point is created to trick clients that are already connected to or associated with the legitimate network to authenticate to the attacker's network instead.
In an example photo below, RedLegg creates the evil twin and configures this fake access point to use the older WPA2 PSK authentication instead of WPA3 SAE in an authentication downgrade attack:
Eventually, one of the clients on the network that has already associated with the legitimate access point and used WPA3 Personal previously, attempted to authenticate to the “evil twin” with the same network name using WPA2 PSK, allowing RedLegg to capture a handshake. An example photo of what this looks like can be observed below:
Because the passphrase was known from the engagement scope, the captured handshake was cracked into plaintext using hashcat, validating the vulnerability and producing documented evidence for the client report. Notably, the client was using a long, complex passphrase, which would have made cracking significantly harder for an outside attacker without prior knowledge. That is worth noting: passphrase complexity is a meaningful secondary control even when transition mode is misconfigured. That distinction matters, but it isn't a case for leaving transition mode enabled. A strong passphrase buys time, not immunity, and it works best alongside eliminating transition mode rather than in place of it.
The tools used to simulate this scenario (including DragonShift) are publicly available and regularly discussed in wireless security research. This is not a theoretical attack path. It is reproducible with widely available tooling.
Wireless security has improved substantially over the past two decades. WPA3 is a better protocol than WPA2 in nearly every measurable way. But configuration matters as much as the protocol itself. An organization running WPA3 with transition mode enabled, auto-connect active on client devices, and no certificate-based authentication is exposed to exactly this attack sequence. Security teams balancing device compatibility requirements often need a documented, phased roadmap for eliminating transition mode as legacy devices are retired, rather than treating it as a single configuration change to revisit someday.
The consequences of a successful Wi-Fi evil twin attack extend well beyond an exposed Wi-Fi password.
In 2024, an Australian man was arrested after setting up evil twin networks at airports in Perth, Melbourne, and Adelaide to harvest email and social media credentials from travelers. He was sentenced to more than seven years in prison in December 2025. The attack required basic, commercially available equipment: no custom exploits or specialized hardware were involved. That is the point worth underscoring. The barrier to entry for this kind of attack is low, and the tools are documented and widely available. The damage to victims was immediate and personal.
Detection requires active monitoring and user awareness. Passive defenses alone are not sufficient.
Prevention requires layered controls, not a single protocol upgrade.
Certain environments carry elevated wireless risk regardless of protocol configuration.
Public environments: Airports, hotels, conference centers, and coffee shops are high-density, high-turnover wireless environments where evil twin attacks are straightforward to operate. The Australian airport case is illustrative: the attacker needed basic equipment and a crowded terminal.
High-risk industries: Healthcare, financial services, and legal organizations carry sensitive data that makes wireless credential exposure particularly consequential. Regulatory frameworks in these sectors increasingly expect documented wireless security controls.
Remote and hybrid workforces: Employees connecting from home networks, co-working spaces, or public venues expand the organizational attack surface beyond the perimeter. Corporate credentials carried on personal devices are exposed to the same attack vectors.
BYOD environments: Personally owned devices connecting to corporate resources are often outside the organization's device management and monitoring scope, making detection harder and prevention more dependent on policy and user behavior.
The attack documented in this post was identified during a network penetration testing engagement, not solely through passive monitoring or configuration review. That distinction matters: configuration reviews describe what should be secure on paper. Testing confirms what is actually exploitable in practice.
A wireless penetration test replicates the adversary's approach. Testers enumerate networks, identify misconfigurations like transition mode, and attempt to execute the attack chain from the outside. The goal is to produce documented evidence of what is exploitable before an actual attacker does.
Specific techniques used in wireless penetration assessments include rogue access point simulation, deauthentication testing, handshake capture and offline cracking, captive portal attacks, and man-in-the-middle traffic interception. Each maps to a real attack path, and each requires a real-world simulation to validate whether existing controls would detect or prevent it.
Configuration review and vulnerability scanning can surface known weaknesses. But they cannot confirm whether a specific configuration is exploitable under real conditions in your environment. Only adversary simulation can do that.
Most wireless security failures are not cryptographic in nature. They are operational.
Assuming a WPA3 upgrade closed the rogue access point gap is an assumption worth testing rather than trusting. Wireless penetration testing validates whether transition mode, auto-connect settings, and certificate policies hold up against a real attack chain, not just a configuration checklist.
RedLegg's penetration testing services help organizations identify wireless vulnerabilities, such as misconfigured authentication settings and transition mode exposure, before attackers exploit them. For organizations managing detection and response alongside offensive testing, our MDR services provide continuous visibility into the environments that penetration testing validates.
We recommend certificate-based authentication available in WPA3-Enterprise, disabling transition mode wherever the device environment permits, and routine wireless auditing as part of a broader security program.
Talk to an expert about wireless security testing for your organization.