FBI and CISA warn election officials of AI-assisted phishing ahead of midterms

A convincing email or familiar-sounding voice may still be bait for account theft. The FBI and Cybersecurity and Infrastructure Security Agency issued an October 16, 2026 advisory warning election and campaign officials that AI can strengthen phishing schemes ahead of the U.S. midterms, helping attackers steal passwords and other sensitive information.

The agencies identify election officials, candidates and political organizations as attractive targets because they have access to voter registration data, current government officials or sensitive campaign information. The warning covers phishing emails and smishing—fraudulent mobile messages—designed to extract information or install malicious software on a recipient’s device.

Fewer obvious clues, more convincing impersonation

The advisory draws a contrast with older phishing messages, which often stood out through spelling mistakes, odd vocabulary or poor grammar. AI lets attackers produce language that sounds genuine, including native-language phrasing and common expressions, the agencies say. That polish can make a malicious link or request for information more persuasive.

The same warning extends beyond written messages. The agencies say adversaries and criminals have used AI-generated video and audio to invent identities, impersonate real people and reinforce phishing schemes. Their concern is not just how a message reads, but whether the apparent person behind it is genuine.

Speed and volume are another part of the warning. The agencies say AI can help attackers conduct sophisticated operations faster and at greater scale, including using tools that continually improve automated phishing emails. Those are the agencies’ descriptions of the threat, not measurements of AI’s impact on this election.

The advisory also describes activity already observed: election officials experienced a surge in phishing attempts during the last two election cycles. Separately, the FBI says it saw an increase in smishing attempts through encrypted chat applications within the past year. Neither observation is presented as a count of AI-assisted attacks.

Defenses beyond spotting a fake

The advisory’s security recommendations begin with phishing-resistant multi-factor authentication, which adds verification beyond a password. The agencies urge its use wherever possible, particularly for email, virtual private networks and accounts that reach critical systems. They also call for current antivirus and anti-malware software, alongside employee education about both email and mobile-message scams.

Other organizational steps

• Give staff a clear way to send suspicious emails to IT for confirmation. Advise them not to open attachments from senders they do not recognize.
• Mark outside emails with an external-source banner, enable strong spam filters and filter messages containing executable files before they reach users.
• Require strong, unique passphrases across password-protected accounts. Do not reuse them or store them on systems an adversary may be able to access.
• Keep operating systems and software updated. Limit each user’s access to the data needed for their duties, and review that access regularly.

Organizations should also use Sender Policy Framework and Domain-Keys Identified Mail, email standards intended to help limit attackers’ ability to impersonate their servers and domain names. If there is evidence of a system or network compromise, the agencies recommend mandatory passphrase changes for affected accounts and clear, consistent documentation of incidents and remediation.

For victims, the FBI requests reports of fraudulent or suspicious activity through a local field office or its Internet Crime Complaint Center. The advisory pairs that reporting route with a broader instruction to election officials and the public: critically evaluate the sources of emails and mobile messages before disclosing sensitive information.