US Election Security: Voting Machine Patch Gaps and AI-Enabled Influence Campaigns

Key facts

Detection coverage

As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4767 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-4767 Election-Themed Lookalike Sender Domain with Credential Lure (T1566)

Detects inbound email from non-government domains that impersonate election offices (election, voter, ballot, county clerk, secretary of state terms) and carry credential or urgency lure subjects. Phishing and impersonation of election officials is the dominant activity cited in the SecurityWeek analysis, and the 2024 hack-and-leak against the Trump campaign began with account compromise. Behaviour-first: it keys on sender-domain impersonation plus lure wording, not static IOCs, because the source publishes no network indicators.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566, T1583.001, T1656
• Data sources: office365_message_trace, email_security_gateway
• Severity: medium
• Confidence: medium

Splunk SPL

index=email sourcetype="o365:reporting:messagetrace" earliest=-24h
| eval sender_domain=lower(mvindex(split(SenderAddress,"@"),1))
```comment("TL-2026-4767 T1566/T1583.001/T1656: election-themed lookalike sender domain that is not .gov or .mil")```
| where match(sender_domain,"(?i)(election|voter|ballot|votebymail|countyclerk|secretaryofstate)")
| where NOT match(sender_domain,"(?i)[.](gov|mil)$")
| where match(lower(Subject),"(?i)(verify|password|credential|urgent|suspend|voter roll|login)")
| stats count AS msgs dc(RecipientAddress) AS recipients values(Subject) AS subjects min(_time) AS first_seen BY sender_domain SenderAddress
| convert ctime(first_seen)
| sort - recipients

Microsoft KQL

EmailEvents
| where Timestamp > ago(24h)
| where EmailDirection == "Inbound"
| where SenderFromDomain matches regex "(?i)(election|voter|ballot|votebymail|countyclerk|secretaryofstate)"
| where SenderFromDomain !endswith ".gov" and SenderFromDomain !endswith ".mil"
| where Subject matches regex "(?i)(verify|password|credential|urgent|suspend|voter roll|login)"
| summarize Messages=count(), Recipients=dcount(RecipientEmailAddress), Subjects=make_set(Subject, 10), FirstSeen=min(Timestamp) by SenderFromDomain, SenderFromAddress
| order by Recipients desc

Sigma

title: Election-Themed Lookalike Sender Domain with Credential Lure
id: 3f6c1a52-8b7e-4d19-a2c4-91e5b07d3a10
status: experimental
description: Detects inbound email from non-government domains impersonating election offices that use credential or urgency lure subjects (TL-2026-4767).
references:
    - https://www.securityweek.com/how-secure-are-us-elections-voting-machine-risks-and-the-growing-threat-of-ai/
author: Threadlinqs Team
date: 2026-10-29
tags:
    - attack.initial-access
    - attack.t1566
    - attack.resource-development
    - attack.t1583.001
    - attack.defense-evasion
    - attack.t1656
logsource:
    product: office365
    service: messagetrace
detection:
    selection_domain:
        SenderDomain|re: '(?i)(election|voter|ballot|votebymail|countyclerk|secretaryofstate)'
    selection_subject:
        Subject|re: '(?i)(verify|password|credential|urgent|suspend|voter roll|login)'
    filter_gov:
        SenderDomain|endswith:
            - '.gov'
            - '.mil'
    condition: selection_domain and selection_subject and not filter_gov
falsepositives:
    - Legitimate election-services vendors, voter-registration NGOs and news outlets sending from commercial domains
level: medium

Known false positives:

• Legitimate election-services vendors, voter-registration NGOs and news outlets mailing from commercial domains
• Internal phishing-awareness simulations that use election-themed lookalike domains

Tuning notes: Add trusted vendor and NGO domains to an exclusion list, scope recipients to election-office and campaign mailboxes, and extend the term list with your jurisdiction's names. Raise severity when recipients >= 5 or the domain was registered in the last 30 days.

• 🔒 TL-2026-4767 Host Resolves Election-Themed Lookalike Domain (T1583.001) · unlock with TL Creds
• 🔒 TL-2026-4767 Free-Webmail Sender Impersonating Election Officials (T1656) · unlock with TL Creds
• 🔒 TL-2026-4767 Removable Media or New Device Connected to Election Management Host (T1200, T1091, T1052.001) · unlock with TL Creds
• 🔒 TL-2026-4767 Office or PDF Reader Spawns Script Interpreter (Phishing Attachment Execution) · unlock with TL Creds
• 🔒 TL-2026-4767 Election Management Data File Modified or Deleted Outside Approved Process (T1565.001, T1485, T1070.004) · unlock with TL Creds
• 🔒 TL-2026-4767 Request Flood Against Election Information Web Endpoints (T1498, T1499.002) · unlock with TL Creds
• 🔒 TL-2026-4767 Exchange Online Forwarding or Mail-Hiding Rule on Election Mailboxes (Hack-and-Leak Staging) · unlock with TL Creds
• 🔒 TL-2026-4767 Mass Robocall with Weak STIR/SHAKEN Attestation or Synthetic Voice (Voter Suppression) · unlock with TL Creds

Indicators of compromise

As of 2026-10-29, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-4767.

Technical analysis

This record is a contextual, analysis-type threat entry rather than a newly disclosed incident. No CVEs, CVSS scores or technical IOCs are stated in the source. Severity (MEDIUM) and status (MONITORING) are analyst judgments; no active exploitation of voting machines is reported.

Patch gap: Shai Bargil (CEO, Sequent) told SecurityWeek that certification of voting systems can occur in any of four election-cycle years and that the process can take up to two years, so that in the worst case machines run software that has gone unpatched for two years or more after certification. He also states that every voting machine delivered to the DEF CON Voting Village, a hands-on election-security lab giving legal access to voting equipment, has been successfully hacked once researchers had hands-on access. Earlier DEF CON Voting Village reports (DEF CON 27, 2019; 2018 and 2024 coverage) similarly describe long-lived unpatched flaws and note that major software changes can force a re-certification process costing over $1 million, which is why fixes are slow to deploy. Physical access is the common precondition in the Voting Village findings. Existing safeguards cited include pre-election testing, chain-of-custody controls, bipartisan poll workers and post-election audits of paper ballots.

Influence operations: Expert commentary in the article (Adam Marre, Arctic Wolf; Bobby Ford, Doppel) states that most observed activity targets disinformation campaigns, social media manipulation, cyber espionage, phishing of election officials and disruption of election-related services rather than direct vote changes, and that attackers can shape public perception through impersonation, fake websites and AI-generated misinformation. The article recounts the 2016 Russian influence campaign (attributed by the CIA, NSA and FBI in 2017, by Special Counsel Robert Mueller in 2019 and by the Senate Intelligence Committee in 2020) and the 2024 Iranian hack-and-leak operation against the Trump campaign. In that case the FBI, ODNI and CISA issued a joint statement on 2024-08-19 attributing the operation to Iran; the campaign had confirmed a breach on 2024-08-10, and documents were leaked to media from an AOL account using the pseudonym 'Robert'. Press reporting says the techniques matched an IRGC-affiliated group; Iran denied involvement.

AI-enabled voter suppression: In January 2024 a deepfake robocall imitating President Biden's voice, delivered with spoofed caller ID two days before the New Hampshire primary, urged Democrats to stay home. The FCC finalized a $6 million fine against political consultant Steve Kramer, who also faced 26 criminal counts in New Hampshire, and Lingo Telecom agreed to a $1 million settlement for transmitting the calls. Alex Quilici (YouMail) notes that targeted robocalls and robotexts are the simplest way to get voters to stay home.

Recommendations in the source: open-sourcing voting-machine software for external review, encrypted verifiable voting records (for example Microsoft ElectionGuard homomorphic encryption), and a CTEM approach emphasizing access control, verifiable backups and multi-layer redundancy. Defenders should focus on phishing resilience for election staff, brand/domain impersonation monitoring, telecom-level robocall authentication, and physical custody of voting equipment.

MITRE ATT&CK techniques by tactic:

Impact

T1565.001 Data Manipulation: Stored Data Manipulation

Initial Access

T1566 Phishing

Resource Development

T1583.001 Acquire Infrastructure: Domains; T1585.001 Establish Accounts: Social Media Accounts; T1585.002 Establish Accounts: Email Accounts; T1588.007 Obtain Capabilities: Artificial Intelligence

Defense Evasion

T1684.001 Impersonation

Remediation

Immediate actions

• Train election officials and staff to recognize phishing, impersonation and AI-generated voice or video content
• Monitor for and take down look-alike election websites and impersonating social media accounts
• Publish official channels for voter information and pre-brief the public on robocall/robotext voter-suppression tactics
• Maintain chain-of-custody and physical access controls over voting equipment

Workarounds

• Continue pre-election logic and accuracy testing and post-election audits of paper ballots
• Use bipartisan poll workers and documented chain-of-custody procedures

Longer-term hardening

• Adopt a CTEM approach: access control, verifiable backups and multi-layer redundancy
• Move toward verifiable encrypted voting records (e.g. Microsoft ElectionGuard) alongside paper-ballot audits
• Open the voting-machine software to independent academic and security-researcher review
• Shorten the certification-to-deployment window so security patches reach machines sooner

Affected and fixed versions

• Various — US electronic voting machines and election-office staff/communications
  Vulnerable versions: Certified voting systems awaiting EAC re-certification of patches (up to two years in worst case)

Timeline

• 2017-01-06 CIA, NSA and FBI attribute the 2016 pro-Trump influence campaign to Russia (2017 intelligence assessment); Special Counsel Robert Mueller (2019) and the Senate Intelligence Committee (2020) later reach the same attribution.
• 2019-09-27 DEF CON 27 Voting Village report published, detailing vulnerabilities in six voting machine models and the slow certification/patching process.
• 2024-01-21 Deepfake robocall imitating President Biden's voice, using spoofed caller ID, urges New Hampshire Democrats not to vote in the primary two days before it is held.
• 2024-05-23 FCC proposes a $6 million fine against Steve Kramer, who also faces 26 criminal counts in New Hampshire for the Biden deepfake robocalls.
• 2024-08-10 Trump campaign confirms a breach after Politico receives anonymous emails with internal campaign documents from an AOL account using the name 'Robert'.
• 2024-08-19 FBI, ODNI and CISA jointly attribute the hack-and-leak against the Trump campaign, and attempted targeting of the Biden-Harris campaign, to Iran; Iran denies involvement.
• 2024-09-26 FCC finalizes the $6 million fine against Kramer; Lingo Telecom separately agrees to a $1 million settlement for transmitting the spoofed robocalls.
• 2026-10-29 SecurityWeek publishes analysis of voting-machine patch gaps, the Voting Village findings and the growing role of AI in election influence and phishing.

Sources cited

• DEF CON 27 Voting Village Report harris.uchicago.edu · Research · 2019-09-27
• How Secure Are US Elections? Voting Machine Risks and the Growing Threat of AI SecurityWeek · News · 2026-10-29
• NPR: A political consultant faces charges and fines for Biden deepfake robocalls npr.org · News · 2024-05-23
• WBUR: FCC finalizes $6M fine for Steve Kramer over Biden robocalls wbur.org · News · 2024-09-27
• TechCrunch: US government accuses Iran of Trump campaign hack techcrunch.com · News · 2024-08-20
• Boing Boing: Report from DEF CON's Voting Village reveals ongoing dismal state of US electronic voting machines boingboing.net · News · 2019-09-27

More in threat intel

• School Bomb Threat Emails: Sender Accounts Linked to Infostealer Data (Vidar, AlienTXTBASE)
• Abuse of legitimate RMM and remote access tools (MeshAgent, ScreenConnect, Ammyy Admin, RDP): Acronis TRU analysis of RMM tool risk for SMBs, incl. CVE-2024-1709
• Lazarus: Weight-Space Backdoor Technique Hidden in Dormant AI Model Neurons (Microsoft Research)
• QuoIntelligence Weekly Snapshot W39 2026: ClickFix/Exvicy, Graphalgo Go RAT, RemControl Android trojan, Windows Defender zero-day exploit (Nightmare Eclipse)
• CRAFTY FALCON: AI-Assisted Financial Threat Actor Targeting Indian BFSI (CERT-In CIAD-2026-0058)

Previous and next in threat intel

• State of Ad Fraud 2026: AI-Assisted Schemes, Malicious iOS Scripts and Messenger Phishing Displace Cloaking Previous report
• GreyNoise: Attack Surges Against Network Infrastructure Vendors Precede CVE Disclosure by a Median of 11 Days (Cisco CVE-2026-20127, Fortinet CVE-2026-24858, SonicWall CVE-2026-0400) Next report