Federal agencies warn that convincing phishing messages, impersonation schemes and synthetic audio and video could help attackers steal sensitive information ahead of the 2026 U.S. midterm elections.
The FBI and the Cybersecurity and Infrastructure Security Agency have issued a joint warning that election officials, candidates and political organisations face cyber threats aimed at stealing credentials and sensitive data.
The advisory, published by CISA and available through the FBI’s Internet Crime Complaint Center, highlights phishing emails, malicious mobile messages and convincing impersonations. Officials are attractive targets because of their access to voter registration information, government contacts and confidential campaign material.
The agencies reported increased phishing against election officials during the previous two election cycles and a rise in malicious messaging through encrypted chat applications over the past year. The announcement does not identify a newly breached voting system or establish that election results have been altered.
AI Makes Fraudulent Messages Harder to Recognise
The advisory describes technology it calls “super intelligence” as enabling more fluent, scalable phishing and convincing synthetic audio and video. Its practical warning is that familiar signs of deception, such as poor grammar and unnatural vocabulary, are becoming less reliable. It does not name a particular model or provide technical benchmarks for that terminology.
Earlier FBI reporting illustrates how synthetic content can support an intrusion without requiring a sophisticated attack on the victim’s device.
In a May 2025 warning, the bureau described attackers sending text messages and AI-generated voice messages while posing as senior U.S. officials. Their approach involved establishing rapport before directing targets to malicious links, sometimes under the pretext of moving a conversation to another messaging service.
The intended outcome was access to personal accounts. Information obtained from those accounts could then help attackers approach additional officials and associates, extending the operation through trusted relationships.
The significance for campaign security is straightforward: a familiar voice or apparently knowledgeable correspondent cannot, by itself, establish that a request is genuine. The FBI advises verifying a sender through independently obtained contact details before following links or sharing information.
Encrypted Messaging Does Not Establish Who Is Speaking
A December 2025 FBI update described impersonation activity dating back to 2023 involving supposed state government officials, White House and Cabinet officials, and members of Congress.
Attackers often began with a text message before requesting a move to an encrypted application such as Signal, Telegram or WhatsApp. They used discussions about current affairs, policy or potential meetings to make the exchange appear credible.
Some subsequently requested sensitive documents, money transfers, authentication codes or introductions to other people. Access to a victim’s contact list could support another round of impersonation.
These findings highlight a distinction relevant to election teams: encryption protects communications in transit, but it does not independently verify a correspondent’s claimed identity. A secure application can still carry a fraudulent request.
For staff handling sensitive communications, requests arriving from a new number or account should therefore be checked through an established contact channel. Continuing the same conversation with the suspected impersonator provides little independent assurance.
Attackers May Seek Account Permissions Instead of Passwords
Another FBI warning adds an important technical dimension to the threat.
In its September 1, 2026 advisory on OAuth consent phishing, the bureau said attackers had targeted prominent individuals, relatives and acquaintances through malicious links sent to personal accounts.
Unlike a conventional credential-stealing page, this technique can direct the victim to a legitimate service’s authorisation screen. The deception lies in persuading the user to grant a malicious application access to their account.
Depending on the permissions approved, the application may be able to read emails, send messages or access files without possessing the victim’s password. The FBI described lures involving supposed file-sharing services, event invitations and identity verification.
This changes both prevention and recovery. A legitimate login page does not mean every application requesting access is trustworthy. Similarly, changing a password may not remove an application’s existing authorisation.
The FBI advises removing the malicious application and revoking its access through account security settings. For election and campaign teams, the implication is that incident reviews must examine connected applications as well as passwords and sign-in activity.
Previous Campaign Intrusions Show How Stolen Data Can Be Weaponised
The potential consequences extend beyond losing control of an inbox.
In charges announced in September 2024, the Justice Department accused three Iranian nationals employed by the Islamic Revolutionary Guard Corps of participating in a hacking conspiracy that included targeting a U.S. presidential campaign.
Prosecutors alleged that the attackers compromised personal accounts belonging to people associated with the campaign, stole non-public documents and emails, and attempted to distribute material to journalists and people associated with a rival campaign.
The alleged techniques included fraudulent identities, spoofed login pages, messages sent from compromised accounts, and attempts to obtain authentication or recovery codes. The charges were allegations, rather than findings of guilt.
The case illustrates why personal accounts can have organisational significance. An attacker may obtain politically sensitive material through an individual’s correspondence without compromising a campaign’s central infrastructure.
It also demonstrates the relationship between intrusion and influence: information theft can become the first stage of an effort to shape public debate through selective disclosure.
Voters Face a Parallel Wave of Election-Themed Fraud
The warning to election personnel follows a separate FBI alert issued on October 15 about fraud exploiting the midterm elections.
That announcement describes criminals using candidate names, photographs, logos and slogans to solicit fraudulent donations, advertise merchandise that never arrives, and collect personal information. AI-generated voices and images can help make those approaches appear authentic.
The schemes include bogus political action committee solicitations and supposed campaign investment pools that promise returns after a candidate wins. The FBI stresses that campaign donations are not investments.
Other messages falsely tell recipients they are not registered to vote, directing them to imitation registration websites designed to collect personal data.
These scams are distinct from operations targeting campaign accounts, but both exploit the authority and familiarity of political identities. The bureau advises people to verify unsolicited approaches independently and use Vote.gov to find official voter registration information. Suspected fraud can be reported through
Stronger Authentication Can Reduce Credential Theft
CISA’s guidance on phishing-resistant multifactor authentication identifies FIDO/WebAuthn-based authentication as a defence against phishing.
The distinction matters because requiring an additional authentication step does not automatically make an account resistant to deception. Attackers may try to obtain one-time codes or persuade users to approve fraudulent sign-in requests.
Organisations should therefore evaluate the authentication method in use, particularly for email, remote access and privileged accounts. CISA also recommends number matching as an interim improvement for organisations using mobile push authentication while they move towards phishing-resistant methods.
Authentication controls should be supported by email protections. CISA’s ransomware prevention guidance recommends phishing-resistant MFA and explains how domain authentication measures, including SPF, DKIM and DMARC, help address fraudulent email.
These controls serve different purposes: authentication protects account access, while email-domain protections help recipients and mail systems assess whether messages are authorised by the domain they claim to represent.
Campaign Resilience Depends on Everyday Security Practices
Comparable guidance from the Canadian Centre for Cyber Security identifies political parties, candidates and their staff as attractive targets for information theft and reputational attacks.
Its recommendations translate the broader threat into practical steps:
- Protect individual accounts: Use unique passwords or passphrases and enable multifactor authentication.
- Keep devices current: Apply operating-system and application updates, including on mobile devices.
- Control shared access: Use platform delegation features and review who can access email, social media and cloud storage.
- Verify unusual requests: Check unexpected instructions from campaign leaders through a separate channel.
- Prepare for disruption: Back up essential information and practise restoring it before an incident.
The Canadian guidance also recommends bringing campaign members together to update their devices and applications, turning security preparation into a coordinated organisational task.
Taken together, the advisories point to a leadership responsibility that extends beyond purchasing security software. Campaigns need established ways to verify requests, manage access and recover essential information—procedures staff can follow when communications are urgent and a convincing message appears to come from someone they trust.
Leave a Reply