Election scams blur with genuine campaign outreach ahead of 2026 US midterms, with phishing, spoofing and exposed election-staff credentials
Check Point Exposure Management reports that fraudulent voter-registration messages and legitimate political outreach are converging ahead of the 2026 US midterms, making it harder for voters to tell real messages from fake ones. Between July and September, election offices in Rhode Island and Washington warned of fake emails and texts asking voters to confirm registration details, and Connecticut's Secretary of the State warned of spoofed email. Some of the lookalike activity involves real third-party groups and campaigns, such as a Texas mailer with a QR code that collected personal information, which dilutes voter trust in official warnings. Researchers saw no activity aimed at voting systems or vote counting, but they flagged exposed election-staff credentials, a large dark web identity-document listing, and election-themed phishing and lookalike domains.
Technical Details
- A Rhode Island phishing email came from an address blending two real state domain names and threatened license revocation within 24 hours. A Pennsylvania text urging recipients to "verify your voter profile" was flagged as malware, though the link led to a political fundraising page.
- On August 31, a seller called Nexus advertised identity document scans for over 170 million people in the US and Canada on a Russian-language forum, including over 153 million driver's licenses, according to the listing. Such data lets attackers craft personalized messages that look credible.
- Researchers found nine credentials tied to Oklahoma State Election Board email addresses, some published as recently as September. It is unknown whether the passwords still work.
- Phishing texts offering a "claim" of a $5,000 payment appeared within hours of the September 9 presidential speech, and the Lamar County Sheriff's Office (Texas) warned residents.
- Phishing sites copied Kalshi and Polymarket with midterm themes. 281 domains sharing one analytics ID sell merchandise under candidate names from both parties; their intent is unknown, but checkout happens on the sites themselves.
- Between September 1 and October 1, about 4,394 new domains contained "vote" and 1,036 contained "election". No active phishing was found on them yet, but such domains often stay idle until the final weeks before an election.
- Edited celebrity video clips carrying news logos were attributed by researchers cited by AFP to a Russian disinformation operation. The article also notes AI-generated opponent likenesses in campaign ads.
- In July, the White House said China and its proxies bought, stole or hacked voter registration data on as many as 220 million Americans, though an official said the intelligence community could not confirm how much was obtained by each method.
Remediation
- Voters should go directly to official state or county election sites rather than using links, QR codes or phone numbers in messages, and should not trust sender addresses or accurate personal details, since breached data supplies both.
- Treat urgency as a warning sign, and set a PIN with the mobile carrier to prevent number porting.
- Election offices should monitor for exposed credentials and require multi-factor authentication; campaigns should clearly identify themselves in all voter outreach.
- Watch for lookalike domains and unexpected election-related messages.
Linha do tempo
-
Election scams blur with genuine campaign outreach ahead of 2026 US midterms, with phishing, spoofing and exposed election-staff credentials
ler a análise desta fonte ocultar
Check Point Exposure Management reports that fraudulent voter-registration messages and legitimate political outreach are converging ahead of the 2026 US midterms, making it harder for voters to tell real messages from fake ones. Between July and September, election offices in Rhode Island and Washington warned of fake emails and texts asking voters to confirm registration details, and Connecticut's Secretary of the State warned of spoofed email. Some of the lookalike activity involves real third-party groups and campaigns, such as a Texas mailer with a QR code that collected personal information, which dilutes voter trust in official warnings. Researchers saw no activity aimed at voting systems or vote counting, but they flagged exposed election-staff credentials, a large dark web identity-document listing, and election-themed phishing and lookalike domains.
Technical Details
- A Rhode Island phishing email came from an address blending two real state domain names and threatened license revocation within 24 hours. A Pennsylvania text urging recipients to "verify your voter profile" was flagged as malware, though the link led to a political fundraising page.
- On August 31, a seller called Nexus advertised identity document scans for over 170 million people in the US and Canada on a Russian-language forum, including over 153 million driver's licenses, according to the listing. Such data lets attackers craft personalized messages that look credible.
- Researchers found nine credentials tied to Oklahoma State Election Board email addresses, some published as recently as September. It is unknown whether the passwords still work.
- Phishing texts offering a "claim" of a $5,000 payment appeared within hours of the September 9 presidential speech, and the Lamar County Sheriff's Office (Texas) warned residents.
- Phishing sites copied Kalshi and Polymarket with midterm themes. 281 domains sharing one analytics ID sell merchandise under candidate names from both parties; their intent is unknown, but checkout happens on the sites themselves.
- Between September 1 and October 1, about 4,394 new domains contained "vote" and 1,036 contained "election". No active phishing was found on them yet, but such domains often stay idle until the final weeks before an election.
- Edited celebrity video clips carrying news logos were attributed by researchers cited by AFP to a Russian disinformation operation. The article also notes AI-generated opponent likenesses in campaign ads.
- In July, the White House said China and its proxies bought, stole or hacked voter registration data on as many as 220 million Americans, though an official said the intelligence community could not confirm how much was obtained by each method.
Remediation
- Voters should go directly to official state or county election sites rather than using links, QR codes or phone numbers in messages, and should not trust sender addresses or accurate personal details, since breached data supplies both.
- Treat urgency as a warning sign, and set a PIN with the mobile carrier to prevent number porting.
- Election offices should monitor for exposed credentials and require multi-factor authentication; campaigns should clearly identify themselves in all voter outreach.
- Watch for lookalike domains and unexpected election-related messages.