FBI and CISA warn of phishing and smishing targeting election and campaign officials ahead of 2026 U.S. midterms
The FBI and CISA issued a joint Public Service Announcement warning that malicious cyber actors may use phishing and smishing against election officials, candidates and political organizations ahead of the 2026 U.S. midterm elections. These targets are attractive because of their access to voter registration data, current government officials and sensitive campaign information. The advisory says that over the last two election cycles officials saw a surge of phishing attempts, and that the FBI has seen an increase in smishing through encrypted chat applications within the last year. Actors are also using what the article calls super intelligence (SI) to write convincing native-language lures, automate and improve email campaigns, and produce deepfake audio and video. The PSA names no specific threat actor, campaign, CVE or IOC.
Technical Details
- Phishing and smishing lures aim to steal login credentials and financial or sensitive information, or to install malware on victim devices.
- SI-generated text removes the old tell-tale signs of phishing such as spelling errors and poor grammar.
- Deepfake video and audio are used to create new identities, impersonate real people and reinforce phishing schemes.
- Smishing is increasingly delivered through encrypted chat applications.
Remediation
- Deploy phishing-resistant MFA on all services where possible, especially email, VPN and accounts that access critical systems.
- Check suspicious content for content credentials or watermarks indicating it was SI-generated.
- Train staff to recognize phishing and smishing, and to verify requests for sensitive information through a secondary channel.
- Mark external emails with a banner, enable strong spam filtering, filter emails containing executables, and implement SPF and DKIM.
- Enforce strong, unique passphrases, role-based least-privilege access and regular access reviews.
- Keep operating systems and software patched, and consult CISA's Known Exploited Vulnerabilities catalog.
- Document incidents and reset passphrases for affected accounts after a compromise.
- Report suspicious activity to the local FBI field office or the FBI IC3.
Linha do tempo
-
FBI and CISA warn of phishing and smishing targeting election and campaign officials ahead of 2026 U.S. midterms
ler a análise desta fonte ocultar
The FBI and CISA issued a joint Public Service Announcement warning that malicious cyber actors may use phishing and smishing against election officials, candidates and political organizations ahead of the 2026 U.S. midterm elections. These targets are attractive because of their access to voter registration data, current government officials and sensitive campaign information. The advisory says that over the last two election cycles officials saw a surge of phishing attempts, and that the FBI has seen an increase in smishing through encrypted chat applications within the last year. Actors are also using what the article calls super intelligence (SI) to write convincing native-language lures, automate and improve email campaigns, and produce deepfake audio and video. The PSA names no specific threat actor, campaign, CVE or IOC.
Technical Details
- Phishing and smishing lures aim to steal login credentials and financial or sensitive information, or to install malware on victim devices.
- SI-generated text removes the old tell-tale signs of phishing such as spelling errors and poor grammar.
- Deepfake video and audio are used to create new identities, impersonate real people and reinforce phishing schemes.
- Smishing is increasingly delivered through encrypted chat applications.
Remediation
- Deploy phishing-resistant MFA on all services where possible, especially email, VPN and accounts that access critical systems.
- Check suspicious content for content credentials or watermarks indicating it was SI-generated.
- Train staff to recognize phishing and smishing, and to verify requests for sensitive information through a secondary channel.
- Mark external emails with a banner, enable strong spam filtering, filter emails containing executables, and implement SPF and DKIM.
- Enforce strong, unique passphrases, role-based least-privilege access and regular access reviews.
- Keep operating systems and software patched, and consult CISA's Known Exploited Vulnerabilities catalog.
- Document incidents and reset passphrases for affected accounts after a compromise.
- Report suspicious activity to the local FBI field office or the FBI IC3.