Carriers pre-populate iOS 8 phones to automatically connect to their wifi signals.
This hack involves spoofing official AT&T and Sprint wifi hot spots that the carrier has forced you to trust.
This earlier bug called WiFiGate has a list of pre-populated trusted wifi networks. From the same group https://www.skycure.com/blog/wifigate-how-mobile-carriers-ex...