It's a way to capture them away from the office.
1. Have access to their computer to retrieve the wpa key. 2. Create a clone of the wifi network, spoof a bunch of sites and hope to catch one that doesn't use http.
Why can't I replace step 2 with: Install a root kit since I already have access to their machine.
1. Find some one to steal a key from but which I don't care about. 2. Locate a third person that I want to target and move close to them in non office hours. 3. Create a clone of their wifi and try to spoof some website. Hopefully I can be close enough to their device that it would join my clone instead of their other preferred networks.
At step 2 seems like a better idea to move close to the office and start probing around?
To get near a target in the wild isn't that hard, especially if you know where they like to go on a regular basis.
It's lot easier than a lot of other methods, especially for a high level target like a C-level exec who might have access to bank accounts with millions of dollars and like to work at a local coffee shop on weekends.
Or park a car outside
An attacker wants to decrypt the packets passed on as the man in the middle without alerting the victim. A big red "insecure connection" browser warning due to an untrusted certificate used by the MITM can easily thwart the attack.
To make this work, the attacker needs access to a CA the victim trusts to sign certificates on the fly. If the attack is limited to a single target page, stealing the associated private key from the legitimate website operator is an option, too.
Redirect all traffic to a site which looks like the corporation you're spoofing, asking for corporate login credentials, how many will enter them reflexively, especially with poor corporations that ask for authentication on a frequent basis.
From memory captive hotspot popups on apple devices at least don't even show the URL they have loaded, but www.targetcorp.com-secure.com etc works well in many cases.