Threat reportPhishingTL-2026-3753
Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials (CISA/FBI PSA261016)
Cyber Threat Actors Use a Variety of Techniques to Target (TL-2026-3753), also tracked as PSA261016, is a medium-severity phishing campaign, first published 2026-10-16. It has no confirmed attribution, affects N/A Election officials, campaign personnel, candidates and political, maps to 7 MITRE ATT&CK techniques (T1204, T1566, T1583.001), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 7MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-3753
- Threat ID
- TL-2026-3753
- Also known as
- PSA261016
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- PHISHING
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, election-infrastructure, political-organizations, campaigns
- Target regions
- North America
- Detection rules
- 9
- Indicators of compromise
- 7
How Cyber Threat Actors Use a Variety of Techniques to Target works
CISA and FBI warn that malicious cyber actors are targeting election officials, campaign personnel, candidates and political organizations ahead of the 2026 U.S. midterms using phishing, smishing, credential theft, malware installation and AI-enhanced impersonation of legitimate sources. The advisory names no CVEs, IOCs or specific threat actors.
A joint CISA/FBI Public Service Announcement (PSA261016, published 2026-10-16 via ic3.gov) warns that malicious cyber actors may use phishing and smishing to steal login credentials and other sensitive information or to install malware on the devices of election officials, campaign personnel and candidates, and political organizations. Stated motivations for targeting are access to voter registration data, information about government officials, and sensitive campaign materials.
The PSA highlights communications that mimic legitimate sources, including emails, text messages, audio and video. It states that AI-generated content makes phishing campaigns larger, more efficient and more effective: messages now use native language and common vernacular (removing historical spelling and grammar tells), and deepfake audio/video can be used to create false identities and bolster phishing schemes. Indicators cited are increasingly sophisticated messages mimicking legitimate communications, unsolicited requests for sensitive information by email or phone, and AI-generated content lacking watermarking or credentials.
The advisory does not attribute activity to a named actor and provides no technical indicators. Separate contextual reporting (Check Point research via Nextgov, June 2026) identifies Russia, Iran and China as the principal state actors to monitor, observes election-themed domain registrations (about 1,300 'election' and 3,000 'vote' domains in January 2026; about 1,140 and 4,000 in April-May 2026), and ~9,500 exposed credentials tied to ActBlue and ~6,500 tied to WinRed. That reporting is context only and is not attributed by CISA/FBI to this PSA. Earlier FBI/CISA reporting (2022 FBI PIN on phishing of election officials; Iranian IRGC-linked phishing of political campaigns) shows the same pattern. Mitigations recommended: phishing-resistant MFA on email, VPNs and critical systems; user training and reporting workflows for phishing/smishing; external-email banners; spam filtering that blocks executable files; SPF and DKIM; strong unique passphrases; least-privilege access with regular review; current anti-malware; and timely patching. Incidents should be reported to local FBI field offices or IC3.
MITRE ATT&CK techniques used in TL-2026-3753
Execution
Initial Access
Resource Development
Reconnaissance
T1589.001 Credentials; T1598 Phishing for Information
initial-access
Defense Evasion
Affected products and versions in Cyber Threat Actors Use a Variety of Techniques to Target
- N/A — Election officials, campaign personnel, candidates and political organizations (user-targeted social engineering)
Remediation for Cyber Threat Actors Use a Variety of Techniques to Target
Patches
- Keep operating systems and software current with vendor patches
Immediate actions
- Report suspicious emails, texts, audio or video to the local FBI field office or ic3.gov
- Treat unsolicited requests for sensitive information by email, text or phone as suspect and verify through a known channel
- Enable phishing-resistant multi-factor authentication on email, VPN and critical systems
Workarounds
- Mark external emails with banners to help prevent spoofing
- Enable strong spam filters that block executable files
- Implement SPF and DKIM email authentication
- Deploy updated antivirus/anti-malware
Longer-term hardening
- Train staff to recognize phishing and smishing, including AI-generated lures and deepfake audio/video
- Establish an incident reporting workflow for suspicious emails
- Apply role-based least-privilege access with regular reviews
- Use strong, unique passphrases for all accounts
Timeline of Cyber Threat Actors Use a Variety of Techniques to Target
- FBI issues a Private Industry Notification on a phishing campaign against U.S. election officials, an earlier instance of the same targeting pattern
- Check Point observes roughly 1,300 new 'election' and 3,000 'vote' domain registrations during January 2026, usable for phishing, fake donation pages and impersonation
- April-May 2026 sees roughly 1,140 'election' and 4,000 'vote' domain registrations according to Check Point
- Nextgov reports Check Point research that actors are laying groundwork against the 2026 midterms, including about 9,500 exposed ActBlue and 6,500 WinRed credentials
- CISA posts the joint alert on its Cybersecurity Advisories feed urging targeted officials to review the PSA, apply best practices and monitor suspicious emails and texts
- FBI and CISA publish PSA261016 warning election and campaign officials of phishing, smishing, credential theft, malware and AI-enhanced impersonation
Sources cited for Cyber Threat Actors Use a Variety of Techniques to Target
- Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials (CISA/FBI)
- FBI/CISA Public Service Announcement PSA261016 (IC3)
- Hackers are already laying groundwork to disrupt the 2026 midterms, research says (Nextgov, citing Check Point)
- FBI PIN: Phishing campaign against U.S. election officials (IC3)
- US Agencies Warn Political Campaigns of Iranian Phishing Attacks (SecurityWeek)
- FBI Warns of Phishing Attacks Targeting US Election Officials (SecurityWeek)
- Election-related phishing attacks (PhishProtection)
Detection coverage for TL-2026-3753
As of 2026-10-16, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3753 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.