One of the most commonly used attacks under evil twins is a captive portal. At first, the attacker would create a fake wireless access point that has a similar Essid to the legitimate access point.
One of the most frequently used attacks under evil twins is a fake gateway. At first, the attacker would create a counterfeit wireless access point that has a similar network name (SSID) to the legitimate access point.