The attacker walks into a Starbucks with a laptop and an off-the-shelf tool like Wifiphisher, Airgeddon, or Fluxion. Within 90 seconds, they broadcast a rogue access point using the same SSID as the real cafe network — “Starbucks_Free_WiFi” — often with a stronger signal than the actual router.

To seal it, the attacker deauthenticates users from the legitimate access point (a legal-gray-area feature built into consumer WiFi tools). Your device, following its automatic reconnect logic, jumps to the strongest available SSID with that name. Congratulations — you’re now connected to the attacker, not Starbucks.

When you open your browser, a login page pops up. It looks exactly like the real Starbucks captive portal because the attacker cloned it byte-for-byte. You enter your email or reward-program credentials, hit submit — and those credentials land in a plain-text file on the attacker’s disk before your browser even shows an error.

According to Bitdefender’s 2025 threat research, captive-portal credential harvesting is the number one goal of Evil Twin operations, ahead of even payment-card theft. The reason: reused passwords let attackers pivot from your loyalty account into your Gmail, corporate SSO, and eventually enterprise VPN.

Once you’re on the rogue AP, all your traffic flows through the attacker before reaching the internet. Modern HTTPS makes reading encrypted content difficult, but attackers still see every domain you visit, every unencrypted request, session cookies from misconfigured sites, and any app that falls back to HTTP. IoT gadgets like fitness bands and smart cameras are notorious for skipping certificate validation entirely.

Session cookies are the real prize. Steal a valid session token from a poorly configured web app, and the attacker gets logged in as you without ever needing your password or MFA code.

Some Evil Twin operators inject malicious JavaScript into unencrypted HTTP responses or push fake browser update prompts. Click one, and you’ve installed an infostealer that harvests saved passwords, crypto wallet files, and browser cookies. In enterprise environments, this becomes the beachhead for ransomware deployment days or weeks later.

Ransomware attacks surged 213% in Q1 2025 versus the same quarter in 2024, and the majority of successful campaigns start with a single compromised endpoint. The IBM Cost of a Data Breach 2024 report pegs the average breach at $4.4 million — a lot of that damage traces back to a laptop that connected to the wrong WiFi.

Legacy antivirus asks one question: “Have we seen this exact file before?” That worked when malware families numbered in the thousands. Today’s crimeware ecosystem produces polymorphic variants by the millions, and signature-based detection catches maybe 40% of active threats. Endpoint Detection and Response (EDR) flips the model entirely — it watches what programs do, not what they are.

If Chrome suddenly spawns cmd.exe which spawns PowerShell which starts encrypting files in your Documents folder, EDR knows that sequence has never happened on your machine before. The response is automatic: kill the process tree, snapshot the state, alert the SOC. This is why platforms like CrowdStrike Falcon and SentinelOne now dominate enterprise endpoint security procurement.

The value of modern endpoint security is measured in seconds. When an EDR platform detects a compromise, it can automatically remove the machine from the network — every open connection dropped, the endpoint quarantined, the SOC paged with forensic data. A ransomware attack that would have burned down a hundred machines gets stopped at machine one.

Real-world case, redacted: In 2024, a mid-market marketing agency had a user click a phishing attachment sent to their personal Gmail while on cafe WiFi. Their CrowdStrike agent isolated the laptop in 8 seconds, blocked outbound C2 traffic, and preserved forensic memory. Damage: one laptop and 30 minutes of user downtime. Without EDR, that’s a multi-million dollar breach.

Extended Detection and Response (XDR) is EDR’s bigger sibling. It correlates endpoint telemetry with email, cloud workloads, identity providers, and network flow data. A single failed login on your laptop means nothing. That same failed login, followed by an unusual OAuth grant in Google Workspace, followed by an S3 bucket enumeration from a new IP — that’s a coordinated attack, and only XDR platforms see the pattern.

For consumers, XDR is overkill and not really purchasable as a standalone product. For any company above 100 employees, endpoint security without XDR is missing half the picture in 2026.