The FBI and CISA have issued a joint Public Service Announcement (PSA261016) warning that cybercriminals are using AI-powered phishing and smishing to target election and campaign officials ahead of the 2026 U.S. midterm elections. The alert, published October 16, says these attacks are getting harder to spot because AI generates messages that look completely legitimate.
Election officials, candidates, and political organizations are attractive targets because of their access to voter registration data, government officials, and sensitive campaign information, according to the agencies. The attackers aim to steal login credentials and sensitive information, or trick people into installing malware.
Why AI phishing is harder to catch
The old giveaway was bad grammar. Phishing emails used to be riddled with spelling mistakes and awkward phrasing, which made them easy to dismiss. The FBI says that trick no longer works: AI, which the PSA calls “super intelligence,” lets criminals generate large volumes of phishing messages written in native, natural language.
It goes further than text. Criminals are using AI to create convincing deepfake video and audio, building fake identities or impersonating real people to make their scams more believable. The FBI also noted a surge in phishing attempts against election officials during the last two election cycles, and an increase in smishing through encrypted chat apps over the past year.
How do I protect myself from AI-powered phishing?
Use phishing-resistant multi-factor authentication on every important account, critically examine who sent any unexpected message before acting on it, and check suspicious content for signs it was AI-generated. If something tries to rush you into sharing credentials or installing software, stop and verify through a separate channel.
- Turn on phishing-resistant MFA for email, VPNs, and every account that protects critical systems.
- Inspect suspicious messages for content credentials or watermarks that indicate AI-generated content.
- Verify unexpected requests through a separate channel before sharing credentials or financial details.
- Never install software or open attachments from an unverified election-related message.
- Report fraud or suspicious activity to your local FBI field office or the FBI’s IC3 portal.
This is a warning, not a breach report
To be clear: the FBI and CISA have not reported any voting systems compromised or any specific victims. This is a preventive advisory based on techniques criminals used in past election cycles, now supercharged by AI. The agencies want officials, campaigns, and the public watching for these tactics before the midterms, not after.
If you receive a suspicious election-related message, the FBI asks that you report it to the Internet Crime Complaint Center (IC3) or contact your local FBI field office directly.
