# Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials (CISA/FBI PSA261016)

> CISA and FBI warn that malicious cyber actors are targeting election officials, campaign personnel, candidates and political organizations ahead of the 2026 U.S. midterms using phishing, smishing, credential theft, malware installation and AI-enhanced impersonation of legitimate sources. The advisory names no CVEs, IOCs or specific threat actors.

- **Published:** 2026-10-16T15:18:33Z
- **Last reviewed:** 2026-10-16T15:18:33Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3753
- **ID:** TL-2026-3753
- **Severity:** MEDIUM
- **Category:** PHISHING
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)

## Description

A joint CISA/FBI Public Service Announcement (PSA261016, published 2026-10-16 via ic3.gov) warns that malicious cyber actors may use phishing and smishing to steal login credentials and other sensitive information or to install malware on the devices of election officials, campaign personnel and candidates, and political organizations. Stated motivations for targeting are access to voter registration data, information about government officials, and sensitive campaign materials.

The PSA highlights communications that mimic legitimate sources, including emails, text messages, audio and video. It states that AI-generated content makes phishing campaigns larger, more efficient and more effective: messages now use native language and common vernacular (removing historical spelling and grammar tells), and deepfake audio/video can be used to create false identities and bolster phishing schemes. Indicators cited are increasingly sophisticated messages mimicking legitimate communications, unsolicited requests for sensitive information by email or phone, and AI-generated content lacking watermarking or credentials.

The advisory does not attribute activity to a named actor and provides no technical indicators. Separate contextual reporting (Check Point research via Nextgov, June 2026) identifies Russia, Iran and China as the principal state actors to monitor, observes election-themed domain registrations (about 1,300 'election' and 3,000 'vote' domains in January 2026; about 1,140 and 4,000 in April-May 2026), and ~9,500 exposed credentials tied to ActBlue and ~6,500 tied to WinRed. That reporting is context only and is not attributed by CISA/FBI to this PSA. Earlier FBI/CISA reporting (2022 FBI PIN on phishing of election officials; Iranian IRGC-linked phishing of political campaigns) shows the same pattern. Mitigations recommended: phishing-resistant MFA on email, VPNs and critical systems; user training and reporting workflows for phishing/smishing; external-email banners; spam filtering that blocks executable files; SPF and DKIM; strong unique passphrases; least-privilege access with regular review; current anti-malware; and timely patching. Incidents should be reported to local FBI field offices or IC3.

## MITRE ATT&CK

- T1566 Phishing
- T1660 Phishing
- T1598 Phishing for Information
- T1589.001 Credentials
- T1583.001 Domains
- T1204 User Execution
- T1684.001 Impersonation

## Sources

- [Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials (CISA/FBI)](https://www.cisa.gov/resources-tools/resources/cyber-threat-actors-use-variety-techniques-target-election-and-campaign-officials)
- [FBI/CISA Public Service Announcement PSA261016 (IC3)](https://www.ic3.gov/PSA/2026/PSA261016)
- [Hackers are already laying groundwork to disrupt the 2026 midterms, research says (Nextgov, citing Check Point)](https://www.nextgov.com/cybersecurity/2026/06/hackers-are-already-laying-groundwork-disrupt-2026-midterms-research-says/413874)
- [FBI PIN: Phishing campaign against U.S. election officials (IC3)](https://ic3.gov/CSA/2022/220329.pdf)
- [US Agencies Warn Political Campaigns of Iranian Phishing Attacks (SecurityWeek)](https://www.securityweek.com/us-agencies-warn-political-campaigns-of-iranian-phishing-attacks/)
- [FBI Warns of Phishing Attacks Targeting US Election Officials (SecurityWeek)](https://www.securityweek.com/fbi-warns-phishing-attacks-targeting-us-election-officials/)
- [Election-related phishing attacks (PhishProtection)](https://phishprotection.com/blog/here-come-the-election-related-phishing-attacks/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3753