Phishing & Smishing Attacks Target Election Officials Ahead of 2026 Midterms
Cyber threat actors are leveraging sophisticated phishing, smishing, and AI-generated audio/video content to steal credentials from election and campaign officials who hold access to sensitive voter data. The root cause is a combination of insufficient security awareness training and inadequate access controls that make high-value targets easy to compromise through social engineering alone. Election personnel are particularly attractive targets because a single compromised account can expose large volumes of personally identifiable voter information. As AI-generated deepfake content becomes more convincing, traditional defenses like spotting 'suspicious-looking' emails are no longer sufficient without layered technical and procedural controls.
Tactical Insight
Immediate Actions
- Enroll all election and campaign staff in targeted phishing and smishing simulation training that includes AI-generated deepfake scenarios.
- Enforce multi-factor authentication (MFA) — preferably phishing-resistant FIDO2/hardware keys — on all accounts with access to voter data or campaign systems.
- Establish and communicate a verified out-of-band callback procedure for any credential requests received via email or SMS.
Long-Term Improvements
- Implement a Zero Trust access model so that compromised credentials alone cannot grant access to sensitive election infrastructure.
- Conduct role-based security awareness programs on a recurring quarterly basis, with content updated to reflect current threat actor tactics.
- Apply the principle of least privilege so election officials only have access to the specific data and systems required for their role.
Detection Measures
- Deploy email security gateways with advanced anti-phishing, anti-spoofing (DMARC/DKIM/SPF), and AI-content detection capabilities.
- Enable centralized logging and alerting for anomalous login attempts, credential reuse, and unusual data access patterns across election systems.
- Establish a clear and low-friction internal reporting channel so staff can quickly flag suspicious messages to the security team.