The card in your hand said “FREE PIZZA.” The back said “GET HACKED.” Same QR code. The only thing that changed was the wording, and that was enough to make you point your camera at an unknown link. That is exactly how real attacks begin. Nobody took your data today. Read on and next time nobody will.
Attackers rarely break in through code first. They break in through you. The technique is called pretexting: wrap a hostile action in a friendly story. “Free pizza,” “Scan for Wi-Fi,” “Menu here,” “Win a prize.” The framing lowers your guard so your thumb moves before your judgement does.
The pixels are identical. Only the story changed. A real attacker only ever shows you the “free pizza” side.
Here is the real sequence a Wi-Fi attacker runs at a conference, café or airport. Each step is small and legal-looking on its own. Chained together, they put your phone on their network, and sometimes on the end of a debugging cable they never had to plug in.
No van, no antenna farm. A Wi-Fi Pineapple (a purpose-built rogue access point) or a Flipper Zero with a Wi-Fi dev board is enough. Both fit in a jacket. Both can pretend to be any wireless network they can hear.
The device listens for the Wi-Fi names (SSIDs) around it (Conference-WiFi, Starbucks, Airport_Free) and starts broadcasting an identical name with a stronger signal. Your phone can’t tell the fake apart from the real one: an SSID is just a text label, and open networks prove nothing about who runs them.
To make sure you land on the twin, the attacker sprays 802.11 deauthentication frames (tiny “you’ve been disconnected” management packets) at everyone nearby. On older/open networks these frames are unauthenticated, so the device can forge them and knock phones and laptops off the genuine access point again and again.
Phones are built to reconnect automatically to “known” networks. After the flood, the strongest network with the familiar name is the attacker’s twin, so your device rejoins it, often silently. Now every request your phone makes flows through the attacker. They can show a fake “sign in to continue” captive portal, or a screen that says “Scan this QR to get online / claim your pizza.”
This is the payload. Once you’re on their network and looking at their screen, the QR they show you isn’t a pizza voucher. It can be an Android wireless-debugging pairing code. Android’s Wireless debugging feature (Developer Options) is designed to be paired by scanning a QR code over the local network. If debugging is enabled and you scan it, the attacker’s laptop pairs with your phone over ADB (Android Debug Bridge): no cable, no obvious prompt.
With a live ADB link on the same network they can mirror your screen, read logs, list and pull files, install apps, and drive the device. On phones with debugging off, the same fake portal instead pushes a malicious app / profile and begs you to install it. Either way, the QR was the doorway.
Once your phone is on their network, and especially once a debug link is live, the damage isn’t hypothetical. This is a realistic list, not a horror story.
Real-time mirroring of whatever you’re looking at: messages, banking, 2FA codes as they arrive.
Photos, documents, downloads and app data pulled straight off the device over the debug bridge.
Session cookies and tokens captured by the man-in-the-middle, logging in as you without your password.
A spyware app or configuration profile pushed and enabled without the usual store warnings.
A foothold that survives after you leave the conference. They don’t need to be near you anymore.
Your contacts and messaging apps become the launch pad to phish the people who trust you.
You don’t need to be technical. Any one of these stops the attack cold. Do a few and you’re a hard target.
Treat an unknown QR like an unknown link in an email. If you must, preview the URL before opening and look for look‑alike domains.
On Android: Settings → System → Developer options → off. This single switch removes the ADB takeover in Step 5.
Stops your phone silently rejoining an “Evil Twin” with a familiar name after a deauth flood.
4G/5G isn’t exposed to the room’s rogue AP, and a VPN encrypts your traffic even if you do land on a twin.
Sudden repeated Wi-Fi drops in a crowded venue can be a live deauth attack. Switch to mobile data and don’t reconnect.
Legit captive portals never need you to install anything or enable debugging. That request is the attack.
Modern Android/iOS harden management frames and warn on rogue profiles. Patches close the doors these tools rely on.
That feeling is the exploit. Pause, and the whole social-engineering chain falls apart before Step 1.
This card was a friendly demo of social engineering and rogue Wi-Fi, two of the tools we use in authorised red-team and penetration tests across the EU & UK. If it made you think twice, imagine what a full assessment reveals about your organisation.