On October 16, 2026, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) published a joint Public Service Announcement, I-101626-PSA, titled "Cyber Threat Actors Use a Variety of Techniques to Target Election and Campaign Officials." It warns that malicious cyber actors may try to disrupt the 2026 U.S. midterm elections by using phishing and smishing (phishing by text message) to steal login credentials and other sensitive information, or to install malware on victims' devices.

The alert describes attack techniques. It is not a breach notification. It names no threat actor, reports no compromise of election systems and contains no numerical statistics. It is advisory guidance, not a binding requirement for state or local election offices. The agencies base the warning on activity seen in past election cycles and over the last year, and they say the lures have become more convincing.

The alert states it plainly: "Election officials, candidates, and their political organizations are attractive targets to malicious cyber criminals."

Why these targets

The PSA explains why. Election offices, candidates and campaigns have access to voter registration data, current government officials and sensitive campaign information. A single stolen password for an election office mailbox, a county portal or a campaign's cloud workspace could open a path to any of those.

The FBI also places the warning in context: "During the last two election cycles, election officials experienced a surge of phishing attempts." The PSA says it is sharing techniques that malicious cyber actors have used during past election cycles, so the 2026 alert reads as a continuation of an established pattern.

What has changed: more convincing lures and a shift to messaging apps

The PSA identifies two developments.

The writing is better. The alert attributes this to what it calls "super intelligence (SI)," its term for advanced AI tools. According to the PSA, "SI allows malicious cyber actors to create language that appears genuine," using native languages and common vernacular. The alert notes that phishing emails were historically recognizable by spelling errors, illogical vocabulary and poor grammar. Those signals are now less reliable. The FBI and CISA say actors have crafted campaigns that "closely resemble legitimate communications." The PSA adds that a growing number of adversaries and criminals have used SI technology to create convincing deepfake video and audio. They use these deepfakes to create new identities, steal the identities of real people and bolster phishing schemes.

Smishing is moving into encrypted chat apps. The FBI writes that "within the last year, the FBI saw an increase of smishing attempts through encrypted chat applications." If campaign staff and volunteers coordinate through such apps on personal phones, those messages may fall outside an organization's email filtering and endpoint monitoring. A lure arriving there can bypass controls an office has built around its email system.

The combination matters because a phishing message no longer needs to look like a phishing message. A text that appears to come from a known colleague, followed by a voice note or video that sounds like that person, gives a recipient few of the cues training usually relies on.

What the alert does not say

Several things are missing from the PSA, and readers should not fill them in:

  • It does not attribute the activity to any nation-state or named group.
  • It does not report any successful intrusion into voting equipment, tabulation or voter registration systems.
  • It gives no counts of incidents, victims or messages.
  • It does not name the encrypted chat applications involved.

What It Means for Defenders

The PSA's guidance is relevant to state and local election offices, the county and municipal IT teams that support them, campaign staff, party organizations and contractors that serve election offices. Its first recommendation is to "Implement phishing-resistant multi-factor authentication (MFA) for all services to the extent possible," particularly for email, virtual private networks and accounts that access critical systems. It points readers to CISA's Implementing Phishing-Resistant MFA fact sheet.

Here is that guidance in practical terms, based on the mitigations the FBI and CISA list:

  • Move to phishing-resistant MFA everywhere it is supported. Phishing-resistant methods are designed so that a credential captured on a fake login page cannot simply be replayed. Start where the PSA says to: email, VPNs and accounts that reach critical systems, including anything that touches voter registration or campaign data. Then extend coverage, as the phrase "for all services" implies.
  • Verify sensitive requests through a second channel. The PSA pairs employee training on phishing and smishing with confirming requests for sensitive information through secondary channels. That control matters more now that a message's text, and possibly a voice or video clip, can be convincing. Requests to reset credentials, share voter files or grant access should be confirmed through a separately known phone number or channel, not by replying to the message that made the request.
  • Give staff a way to report. The PSA recommends a process for employees to send suspicious emails to IT for confirmation, and advises against opening attachments from unrecognized senders.
  • Check for signs of synthetic media. The alert suggests examining suspicious content for content credentials or watermarking that indicate it was SI-generated.
  • Mark external email. Add banners to messages from outside the organization so that spoofed senders are easier to spot.
  • Filter at the gateway. Enable strong spam filters and filter out emails containing executable files before they reach users.
  • Implement SPF and DKIM. The PSA recommends the Sender Policy Framework and DomainKeys Identified Mail standards to help limit spoofing of an organization's servers and domain name in phishing emails.
  • Keep anti-malware current and patch promptly. The PSA lists up-to-date antivirus and anti-malware software and timely patching as baseline controls, and points to CISA's Known Exploited Vulnerabilities catalog for newly exploited flaws. The alert cites no specific CVEs.
  • Use strong, unique passphrases. The PSA says passphrases should not be reused across accounts, and that affected accounts should get mandatory passphrase changes if there is evidence of compromise.
  • Enforce role-based, least-privilege access. Limit each user to the data their duties require and review access regularly, so that one phished account does not expose everything.
  • Document incidents. The PSA asks organizations to record security incidents and remediation clearly, consistently and transparently.

Contractors and IT providers supporting election offices would be wise to apply the same controls to their own accounts. A compromised vendor mailbox could deliver a lure to an election office that already trusts that vendor.

Campaigns that rely on encrypted messaging apps can put the PSA's secondary-channel advice into practice with a simple internal rule: any request in those apps involving credentials, files, money or account changes is confirmed by a call to a known number before anyone acts on it. That applies the verification step on the channel where the FBI says smishing attempts have increased.

How to report

The FBI and CISA ask the public to report suspicious activity to a local FBI field office or to the FBI's Internet Crime Complaint Center at ic3.gov.

The bottom line

I-101626-PSA does not describe a new vulnerability or a confirmed breach. It describes established techniques that have become harder to spot, aimed at people whose accounts give access to voter registration data, government officials and campaign information. The agencies' central advice is phishing-resistant MFA on every service that supports it, backed by email authentication, gateway filtering, least-privilege access and verification of sensitive requests through a separate channel.

Sources