MiTM phishing attack can let attackers unlock and steal a Tesla

Researchers demonstrated a practical MiTM phishing attack at Tesla locations by spoofing a "Tesla Guest" WiFi SSID to capture account credentials and OTPs; with the stolen account the attacker can add a Phone Key to a nearby car (no card authentication or owner notification required) and unlock/start the vehicle, enabling theft of Tesla Model 3s without needing malware or physical intrusion.