Your phone picks WiFi by its name. That name is not unique and not verified. Anyone can broadcast it.
On WPA2, an access point only proves it knows the password. It never proves who it is. Clone the name, know the password, and you are indistinguishable from the real one.
That one gap is the whole attack. WPA3 with Protected Management Frames is the fix, which is exactly why this is shown on WPA2.
A tiny ESP32 broadcasts the same name and password, then turns its signal up until your phone roams to it on its own. No attack, just a louder clone.
The twin passes your traffic out through its own uplink, so the internet keeps working and nothing feels wrong. No deauth, no jamming. It just out-signals and waits.
Tap any part of the system to see what it does.
The victim's traffic goes victim → twin → uplink. Meanwhile every beacon on the air radiates to the sniffer, which feeds the Watcher.
It never looks at the name. It reads the radio fingerprint: beacon timing, signal jitter, which info-elements are present. An AI telling one radio from another.
The attacker evolves a disguise to slip past. The deployed detector dips. The Watcher retrains and recovers.
The chip ships with its defences off by default. That same weakness lets the Watcher do more than switch it off. Tap through the ladder.
Flash encryption is off, so the secrets sit in the open. "Authenticated" is only as strong as the chip's secret storage, and by default that is an open book.
The same chip has really been read, crashed, and owned in the wild. Tap a case.
Detect with the Watcher · harden clients with WPA3/PMF · encrypt the flash · never hardcode a secret.