October 16, 2026 — The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint public service announcement on Friday warning that attackers are likely to target election and campaign officials with phishing emails and scam text messages ahead of next month’s 2026 U.S. midterm elections, and that modern AI tools are making those lures substantially harder to recognize. Why it matters: the people who run elections hold exactly the credentials and voter data attackers want, and the old tell — sloppy wording — is disappearing.
What the agencies warned about
The announcement says malicious actors may try to disrupt the midterms by using phishing and text-message scams, often called smishing, to steal login credentials and other sensitive information. It singles out election officials, candidates and their political organizations as especially attractive targets because of their access to voter registration data, sitting officials and sensitive campaign material.
The agencies note that phishing attempts against election officials surged across the last two election cycles, and that the FBI has seen more smishing attempts arriving through encrypted chat applications over the past year.
How AI changes the phishing problem
Historically, fake messages often gave themselves away through spelling mistakes and awkward phrasing. The announcement says AI tools now let attackers write clean, natural-sounding messages at much larger scale, including in a target’s native language and everyday style. It also flags convincing fake audio and video as a growing part of the toolkit, used to impersonate real people, invent identities and make an initial scam message more believable.
The agencies describe a feedback loop as well: automated systems can learn from which messages succeed and steadily improve the next batch, letting a small operation run campaigns that once took far more manual work.
In a separate warning this week, the FBI also alerted the public to election-season fraud schemes that borrow candidate names, images and slogans to solicit fake donations, sell merchandise that never arrives or harvest personal information, again with AI-generated voices, images and messages making the impersonations more realistic.
What officials are being told to do
The guidance is practical rather than exotic. For individuals, the top recommendation is phishing-resistant multi-factor authentication, particularly on email, VPN and critical-system accounts, plus checking whether suspect content carries credentials or watermarks indicating it was AI-generated.
For organizations, the list includes staff training on spotting phishing and smishing, verifying unexpected requests for sensitive information through a second channel, sending suspicious messages to IT instead of opening attachments, flagging external email with banners, keeping strong spam filters and patching current, using strong and unique passphrases, applying email anti-spoofing standards, and limiting each account to only the access its role requires. Suspected fraud can be reported to a local FBI field office or through the Internet Crime Complaint Center.
Why it matters
Nothing in this warning requires a breakthrough model or a nation-state budget. The risk it describes is volume plus believability: more messages, written better, aimed at a small group of people whose accounts open doors to voter data and public trust. For Tested Intelligence readers, the takeaway is broader than elections — if AI-polished phishing is now the baseline assumption for election offices, it is the baseline for every small business and campaign inbox too, and phishing-resistant sign-in is the single defense the agencies keep putting first.
Frequently asked questions
Who issued the election phishing warning?
The FBI and CISA issued it jointly as a public service announcement on October 16, 2026, ahead of the 2026 U.S. midterm elections.
What kinds of messages should officials watch for?
Phishing emails and smishing text messages designed to steal credentials or sensitive data, including messages arriving through encrypted chat apps, and AI-generated voice, image or video impersonations.
What is the agencies’ top defense recommendation?
Phishing-resistant multi-factor authentication on email, VPN and critical accounts, backed by staff training and a habit of verifying sensitive requests through a second channel.
Where can suspected election fraud be reported?
To a local FBI field office or through the FBI’s Internet Crime Complaint Center (IC3).
Sources: FBI / CISA public service announcement via IC3, Reuters, Help Net Security