The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are providing this Public Service Announcement (PSA) to raise awareness of the cyber threats facing election and campaign officials during the upcoming 2026 U.S. midterm elections. Additionally, this announcement provides the public with information on techniques, including phishing1 and smishing2, that malicious cyber actors have used during past election cycles.
Malicious cyber actors may attempt to disrupt the 2026 U.S. midterm elections using phishing and smishing techniques to steal user data, including login credentials and sensitive information. Election officials, candidates, and their political organizations are attractive targets to malicious cyber criminals due to their access to voter registration data, current government officials, or sensitive campaign information.
In recent years, these actors have crafted increasingly sophisticated phishing and smishing campaigns that closely resemble legitimate communications, making it difficult for targets to distinguish fraudulent messages. The rise in super intelligence (SI) creates additional opportunities for malicious actors to generate larger, more efficient, and more effective phishing email campaigns.
Historically, phishing emails were recognizable due to spelling errors, illogical vocabulary, and poor grammar. SI allows malicious cyber actors to create language that appears genuine, using native languages and common vernacular, making it more likely for potential victims to click malicious links or inadvertently expose information through direct interaction with threat actors. Additionally, a growing number of adversaries and criminals have used SI technology to enable the creation of convincing deepfake video and audio recordings. Cyber threat actors use these deepfakes to create new identities, steal the identities of real people, create realistic facsimiles of daily life and communication, and bolster phishing schemes.
During the last two election cycles, election officials experienced a surge of phishing attempts and within the last year, the FBI saw an increase of smishing attempts through encrypted chat applications. Malicious cyber actors will continue to develop innovative technologies to breach digital defenses. SI serves as an evolutionary step by allowing malicious cyber actors to carry out sophisticated operations quicker and at a greater scale. Malicious cyber actors now use SI tools to facilitate a continuous learning process that improves the effectiveness of automated email messages in phishing attempts.
The FBI and CISA urge election officials and the American public to critically evaluate the sources of their emails and mobile messages. Such precautions are critical to remaining vigilant for phishing and smishing attempts that try to manipulate the recipient into disclosing sensitive information, such as login credentials or financial information, or that install malware on their devices. A comprehensive cybersecurity approach is essential to combat the cyber threat and protect digital information.
Tips to Protect Yourself
- Implement phishing-resistant multi-factor authentication (MFA) for all services to the extent possible, particularly for email, virtual private networks, and accounts that access critical systems. See CISA's Implementing Phishing-Resistant MFA fact sheet for guidance.
- Examine potentially malicious content for content credentials or watermarking indicating that it was SI-generated.
Tips to Protect Your Organization
- Implement or enhance existing security infrastructure. Ensure your organization has the latest antivirus/anti-malware software installed that detects and defends against inbound malware, spam, and new and sophisticated phishing campaigns. Further, ensure your organization has implemented phishing-resistant MFA. For information on newly exploited vulnerabilities please refer to CISA's Known Exploited Vulnerabilities catalog.
- Educate employees on how to identify phishing and smishing attempts. Advise employees to be cautious when providing sensitive information — such as login credentials — electronically or over the phone, particularly if unsolicited or anomalous. Employees should confirm, if possible, requests for sensitive information through secondary channels.
- Create processes for employees to send suspicious emails to IT departments for confirmation and advise personnel within your organization not to open email attachments from senders they do not recognize.
- Mark external emails with a banner denoting they are from an external source to assist users in detecting spoofed emails.
- Enable strong spam filters to prevent phishing emails from reaching end users. Filter emails containing executable files from reaching end users.
- Require all accounts with password logins (e.g., service account, admin accounts, and domain admin accounts) to have strong, unique passphrases. Passphrases should not be reused across multiple accounts or stored on the system where an adversary may have access. (Note: Devices with local administrative accounts should implement a password policy that requires strong, unique passwords for each individual administrative account.)
- If there is evidence of system or network compromise, implement mandatory passphrase changes for all affected accounts.
- Document all security incidents and remediation activities clearly, consistently, and transparently.
- Keep all operating systems and software up to date. Timely patching is one of the most efficient and cost-effective steps an organization can take to minimize its exposure to cybersecurity threats.
- Implement and use the Sender Policy Framework and Domain-Keys Identified Mail standards to help limit spoofing of the organization's servers and domain name for use in phishing emails.
- Implement role-based, least privileged access, with each user limited to the data required for their duties and access reviewed regularly.
The FBI is responsible for investigating and prosecuting election crimes, specific to foreign influence and interference operations targeting election infrastructure and other U.S. democratic institutions. CISA is responsible for helping critical infrastructure owners and operators, including those in the election community, remain resilient against physical and cyber threats. The FBI and CISA provide services and information to uphold the security, integrity, and resiliency of the U.S. electoral process.
Resources
Report It
The FBI requests victims report these types of fraudulent or suspicious activities to their local field office (www.fbi.gov/contact-us/field), or to the FBI Internet Crime Complaint Center (IC3).
For additional information, please visit the following website: www.fbi.gov/scams-and-safety/common-scams-and-crimes/election-crimes-and-security.