The U.S. FBI and the Cybersecurity and Infrastructure Security Agency (CISA) have issued joint advisories warning of election-themed scams targeting voters and spear phishing attacks targeting election officials.
“Scammers use the names, images, logos, and slogans of candidates to fraudulently solicit campaign contributions, sell merchandise that is never delivered, or steal personally identifiable information (PII) that can be used for other fraud,” the FBI says. “Scammers also exploit artificial intelligence (AI) tools to generate highly realistic voices, images, and written messages that impersonate candidates, campaigns, government entities, and trusted contacts. The realism makes these schemes harder for victims to detect and increases the likelihood of financial loss or exposure of PII.”
These scams include soliciting donations for phony Super PACs, campaign investment pool schemes and phishing attacks using voter registration as a lure.
Additionally, attackers are launching more targeted social engineering attacks against people involved in politics, using AI tools to craft extremely realistic messages.
“Election officials, candidates, and their political organizations are attractive targets to malicious cyber criminals due to their access to voter registration data, current government officials, or sensitive campaign information,” “In recent years, these actors have crafted increasingly sophisticated phishing and smishing campaigns that closely resemble legitimate communications, making it difficult for targets to distinguish fraudulent messages.”
The FBI and CISA advise organizations and individuals to follow security best practices to thwart social engineering attacks:
- “Implement or enhance existing security infrastructure. Ensure your organization has the latest antivirus/anti-malware software installed that detects and defends against inbound malware, spam, and new and sophisticated phishing campaigns. Further, ensure your organization has implemented phishing-resistant MFA. For information on newly exploited vulnerabilities please refer to CISA's Known Exploited Vulnerabilities catalog.
- Educate employees on how to identify phishing and smishing attempts. Advise employees to be cautious when providing sensitive information — such as login credentials — electronically or over the phone, particularly if unsolicited or anomalous. Employees should confirm, if possible, requests for sensitive information through secondary channels.
- Create processes for employees to send suspicious emails to IT departments for confirmation and advise personnel within your organization not to open email attachments from senders they do not recognize.”
The FBI has the story: https://www.ic3.gov/PSA/2026/PSA261015-3
