[lxgr]

Hidden SSIDs use beacon frames too, as far as I remember. They just don‘t broadcast their SSID in it, but clients can see them and then interrogate them ("are you part of SSID xyz?").