The FBI and the Cybersecurity and Infrastructure Security Agency warned election officials, candidates and political organizations Friday that attackers are targeting them with phishing emails, text messages and deepfakes ahead of the 2026 midterm elections, and that artificial intelligence is making those lures harder to spot. With the Nov. 3 vote less than three weeks away, the alert puts election offices, campaigns and the vendors that work with them on notice to lock down email and remote-access accounts now.
What Happened
The joint public service announcement, "Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials," was published on the FBI's Internet Crime Complaint Center site and posted by CISA the same day. It says election officials, candidates and their organizations are attractive targets because of their access to voter registration data, their standing as current government officials or their sensitive campaign information.
The agencies describe two main techniques. The first is phishing, fraudulent emails dressed up to look as if they come from a trusted source, often sent from addresses nearly identical to legitimate ones. The second is smishing, the same trick delivered by text message. The FBI says it has seen more smishing attempts through encrypted chat applications over the past year. The goal, according to the alert, is to steal login credentials and other sensitive information or to get malware onto victims' devices. The agencies say election officials experienced a surge of phishing attempts during the last two election cycles, though the alert gives no figures.
The alert says AI tools, which it calls "super intelligence," let attackers write convincing, native-sounding messages, run larger campaigns and refine their emails over time. Spelling mistakes and clumsy grammar once gave many phishing attempts away; the agencies say those warning signs are disappearing. The alert also warns that attackers use AI-generated audio and video, known as deepfakes, to invent identities, impersonate real people and make their schemes more believable.
The PSA does not name any country, government or criminal group. It refers only to malicious cyber actors, adversaries and criminals.
Why It Matters
For campaign leaders and election administrators, the guidance is concrete. The agencies urge phishing-resistant multifactor authentication, meaning login checks such as hardware security keys that a fake website cannot capture, on every service possible and especially on email, virtual private networks and accounts for critical systems. They ask staff to verify unusual or unsolicited requests for sensitive information through a second channel, such as a phone call to a known number, and to check suspicious media for content credentials or watermarks that show it was AI-generated.
For organizations, the list adds banners on emails from outside senders, blocking attachments that contain executable files, SPF and DKIM email-authentication records that make it harder to spoof a domain, unique passphrases for administrator accounts, least-privilege access and patching against CISA's catalog of known exploited vulnerabilities. Vendors that hold voter data or run campaign systems face the same exposure as the offices they serve.
A Different Alert From the Day Before
The PSA is separate from an Oct. 15 FBI alert, which warned that scammers are using AI to impersonate candidates to defraud donors and voters. That alert dealt with fraud carried out in a campaign's name. Friday's alert concerns attempts to break into the accounts and systems of election offices and campaigns themselves. Both arrive as election offices report fewer federal points of contact after cuts to federal programs that tracked foreign influence.
What to Watch
- Reports of account compromises or deepfake incidents at election offices and campaigns before Nov. 3.
- Whether federal agencies attribute any election-related intrusions to a specific foreign government or group, which this alert does not do.
- Further joint FBI-CISA guidance as the vote nears. The agencies ask that suspicious activity be reported to a local FBI field office or to the Internet Crime Complaint Center.
