Evil Twin Access Point HTTP Credential Capture

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects attempts to capture credentials via an 'Evil Twin' access point by looking for HTTP POST requests to URIs containing both 'login' and 'wifi'. This combination suggests a malicious captive portal designed to trick users into submitting their credentials.