Evil Twin Access Point Credential Capture Portal

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects network traffic indicative of an 'Evil Twin' access point credential capture portal. It specifically looks for HTTP POST requests where the URI contains both 'wifi' and 'password' (case-insensitive). This pattern suggests a malicious portal designed to trick users into entering their Wi-Fi credentials.