Flipper Zero WiFi phishing attack can unlock and steal Tesla cars

Researchers demonstrated a MiTM phishing attack using a spoofed 'Tesla Guest' WiFi (performed with a Flipper Zero but reproducible with other devices) to steal Tesla account credentials and OTPs; once authenticated the attacker can add a new Phone Key without requiring the vehicle owner's physical key card, allowing them to unlock and start the car while in close proximity. Tesla reviewed the report and considered the behavior intended; no mitigation was described in the report.