Australian dad creates “evil twin” WiFi to lurk in women’s social media accounts

An Australian dad who created a fake WiFi to spy on women and exfiltrate their intimate images has pleaded guilty.

The Western Australian man, Michael Clapsis, 43, created what Australian Federal Police (AFP) are calling an “evil twin” WiFi to steal personal information from unsuspecting victims.

The AFP’s Western Command Cybercrime Operations Team analyzed Clapsis’ data and devices and found dozens of credentials belonging to victims alongside fake WiFi pages.

Clapsis was charged in May 2024 after airlines discovered a suspicious WiFi network identified by its employees.

Investigators apprehended the man and searched his bag upon his return to Perth Airport in April 2024.

AFP investigators found a portable wireless access device, a laptop, and a mobile phone in his hand luggage. His home was also searched.

Following the searches, Clapsis deleted over 1,750 files from his account and attempted to erase all data from his phone, which was unsuccessful, WA Today reports.

Police said that the man used the hotspot to create “evil twin” free WiFi networks, luring victims into believing they were real services.

When people attempted to connect their devices to the fake networks, they were redirected to a webpage that asked them to provide their credentials in order to sign into the free WiFi.

These credentials were mainly email or social media logins, which were then saved to Clapsis’ devices.

Clapsis could then use these stolen credentials for a variety of reasons, to access private social media accounts, obtain financial information, or view stored images and videos.

That’s what the AFP alleged back in June 2024. Now, there’s more information on what Clapsis actually used that data for.

The man accessed social media accounts and other online spaces relating to women, which were used to monitor their messages and steal intimate images and videos, WA Today reports.

Clapsis also used a software tool to gain unauthorized access to his employer’s laptop, accessing confidential meetings between his employer and the AFP regarding his situation, WA Today said.

A plea deal has been reached, which dropped Clapsis’ charges from 31 to 15. Clapsis will return to court in August where sentencing will be set.