Verify Messages Before Clicking: AI-Phishing Threatens 2026 Election Staff
FBI and CISA warn that super intelligence enables convincing phishing and smishing attacks targeting election officials and their sensitive data.
Key points
- Super intelligence allows threat actors to create grammatically perfect phishing messages in native languages.
- Election officials are targeted for voter registration data, campaign info, and access to government contacts.
- Smishing attempts via encrypted chat applications increased significantly in the year prior to this advisory.
Election officials, candidates, and political organizations face heightened cyber risks during the upcoming 2026 U.S. midterm elections, according to a joint public service announcement from the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency. These groups are attractive targets because they hold sensitive voter registration data, maintain contacts with current government officials, and manage confidential campaign information. Malicious actors aim to steal login credentials and other sensitive personal or organizational data through deceptive communications.
Root cause
The primary driver behind the increased sophistication of these attacks is the adoption of super intelligence tools by cyber criminals. Historically, phishing emails were often identifiable by spelling errors, poor grammar, or illogical vocabulary choices. Super intelligence removes these linguistic barriers, allowing adversaries to generate text that appears genuine and uses common vernacular. This technological shift enables threat actors to craft messages that closely resemble legitimate communications, making it significantly harder for recipients to distinguish between fraud and authentic correspondence.
Attack path
Threat actors utilize phishing via email and smishing via mobile messages to manipulate recipients into disclosing sensitive information or installing malware. The FBI observed an increase in smishing attempts through encrypted chat applications within the year leading up to this advisory. Additionally, adversaries are using super intelligence to create convincing deepfake video and audio recordings. These synthetic media assets help criminals create new identities, impersonate real people, and bolster their phishing schemes by establishing a realistic facsimile of daily life and communication.
Affected versions
This advisory does not identify specific software versions, operating systems, or CVE identifiers. Instead, it addresses a broad class of social engineering attacks targeting human behavior and communication channels. The threat applies to any individual or organization involved in the 2026 election cycle who uses email, mobile messaging, or encrypted chat applications. The risk is not tied to a specific software bug but to the evolving capability of threat actors to bypass traditional detection methods through advanced language generation and media synthesis.
Mitigation
- Implement phishing-resistant multi-factor authentication for all services, particularly email, virtual private networks, and accounts accessing critical systems.
- Examine potentially malicious content for credentials or watermarking that indicates it was generated by super intelligence.
- Ensure organizations have the latest antivirus and anti-malware software installed to detect inbound malware and sophisticated phishing campaigns.
- Refer to CISA’s Known Exploited Vulnerabilities catalog for information on newly exploited vulnerabilities in software infrastructure.
For customers and users
If you work in elections or politics, treat every unexpected message with caution. Verify requests for sensitive data through a separate, trusted channel. Look for subtle signs of AI-generated text, such as overly formal tone or generic greetings. Be skeptical of urgent requests sent via encrypted apps, as these are now common smishing vectors. Do not click links or download attachments from unknown sources. If a message includes audio or video, check for inconsistencies that might indicate a deepfake. Report suspicious activity to your security team immediately.
Background: Threat actors
A threat actor is any individual or group that initiates a security incident. The term distinguishes the person or organization behind the attack from the technical method used. Analysts use this classification to predict future behavior and tailor defenses based on the actor’s goals rather than just their tools.
Read the full guide: Threat Actors Defined: Who They Are and How They Operate
What to do and how to stay safe: FBI
- Enable phishing-resistant multi-factor authentication on all email and critical service accounts to prevent credential theft.
- Verify the source of any unexpected request for sensitive information by contacting the sender through a known, trusted method.
- Update antivirus and anti-malware software to ensure protection against the latest automated phishing and malware campaigns.
- Check for watermarks or credentials in digital media that indicate the content was generated by artificial intelligence.
Step-by-step guide: Passkeys Explained: How Passwordless Login Actually Works
General security guidance from the DarkWeb Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why are election officials specifically targeted by these cyber threats?
They have access to voter registration data, sensitive campaign information, and contacts with current government officials.
How does super intelligence change the nature of phishing attacks?
It allows criminals to create grammatically correct, native-language messages and realistic deepfake media that mimic legitimate communications.
What types of messages are involved in these attacks?
Attackers use both phishing emails and smishing messages, with a noted increase in attempts via encrypted chat applications.
