As reported by CISA, the agency — alongside the FBI — released a Public Service Announcement on October 16, 2026, warning that cyber threat actors are actively targeting election officials, candidates, and campaign organizations during the 2026 U.S. midterm cycle. The advisory highlights phishing and smishing as primary attack vectors, with actors deploying increasingly convincing emails, text messages, and multimedia content to steal credentials and deploy malware.

Threat Intelligence: As reported by CISA, the agency — alongside the FBI — released a Public Service Announcement on October 16, 2026, warning that cyber threat actors are actively targeting election officials, candidates, and campaign organizations during the 2026 U.S.

What sets this PSA apart from routine election-season warnings is its explicit acknowledgment that threat actors are now leveraging audio and video content as part of their social engineering toolkit. This signals a shift from traditional text-based phishing toward AI-generated or manipulated media — voice cloning of officials, fabricated video statements, and synthetic personas designed to bypass the skepticism that conventional phishing often triggers.

Why This Matters

Election infrastructure sits at a unique intersection of data sensitivity and operational fragility. Officials handle voter registration databases, internal communications with government leaders, donor information, and campaign strategy documents. A single compromised credential can cascade into voter data exposure, disinformation amplification, or disruption of election operations themselves.

The threat surface is also unusually broad. Unlike enterprise environments with dedicated security teams, many local election offices and campaign organizations operate with minimal cybersecurity staff, legacy systems, and personal devices used for official communications. This creates asymmetric exposure — high-value targets with low defensive maturity.

Who Is at Risk

Why This Matters
State, local, tribal, and territorial election officials — particularly small jurisdictions with limited IT budgets
Campaign staff and volunteers who use personal phones and email accounts for campaign work
Candidates themselves, who are high-profile targets for credential theft and impersonation
Third-party vendors supporting election logistics, voter outreach, and data management

The Deepfake Factor

The inclusion of audio and video content in CISA's threat description is a bellwether. Defensive training that focuses solely on spotting suspicious email headers and malformed URLs is no longer sufficient.

Defenders must now account for synthetic media that can mimic a candidate's voice well enough to trick staff into authorizing wire transfers, sharing access codes, or disclosing strategic plans. The barrier to producing convincing deepfakes has dropped dramatically, and election season provides a high-motivation, time-pressured environment where recipients are more likely to act first and verify later.

Shield53 Recommendations

Immediate Actions:

  • Enforce MFA everywhere — phishing-resistant MFA (FIDO2/WebAuthn) on all email, voter registration systems, and campaign platforms. SMS-based MFA is insufficient against SIM-swapping and smishing.
  • Deploy smishing defenses — implement mobile threat defense on staff devices, restrict app installations, and train staff to treat unexpected SMS links with the same suspicion as email links.
  • Establish verification protocols — any request involving credentials, financial transfers, or sensitive data shared via voice or video must be verified through a secondary, pre-established out-of-band channel.
  • Segment election systems — voter registration databases and election infrastructure should be network-isolated from general office communications and campaign operations.
  • Tabletop the deepfake scenario — run exercises simulating a cloned-voice call to a campaign official requesting urgent credential sharing or fund transfers. Measure how quickly staff escalate vs. comply.
  • Monitor for exposure — use credential monitoring services to detect leaked official email addresses and passwords across breach databases and dark web sources.

Broader Guidance:

  • Review CISA's full PSA and distribute to all election and campaign staff.
  • Implement the controls in CISA's Personal Security Considerations Action Guide for all personnel handling sensitive election data.
  • Engage with CISA's election security services — including cyber hygiene scans and vulnerability assessments — available at no cost to election offices.

The 2026 midterms will be the first U.S. election cycle where AI-enabled social engineering is both widely accessible to threat actors and largely unmitigated on the defender side. Election offices and campaigns that treat this PSA as a routine advisory rather than an operational mandate are gambling with infrastructure that democracy depends on.