One of the most commonly used attacks under evil twins is a captive portal. At first, the attacker would create a fake wireless access point that has a similar Essid to the legitimate access point.
A common attack employed by evil twins involves intercepting wireless connections through a proxy server. Initially, an attacker creates a fake wireless access point with a similar SSID to the genuine one.