FBI-CISA warn of AI-enhanced election phishing
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
FBI and CISA warn that threat actors are using AI/SI tools to craft convincing phishing, smishing, and deepfakes targeting 2026 midterm election and campaign officials.
The FBI and CISA issued a joint Public Service Announcement warning that election officials, candidates, and campaign organizations remain attractive targets for phishing and smishing campaigns ahead of the 2026 U.S. midterm elections. The advisory highlights that malicious actors increasingly leverage "super intelligence" (SI/AI) tools to generate grammatically convincing, native-language phishing content that is harder to distinguish from legitimate communications, and to produce deepfake audio/video used for identity theft or to bolster social engineering. The FBI also noted a recent rise in smishing attempts conducted through encrypted chat applications.
No specific threat actor, malware family, or active campaign is named; this is a general awareness advisory rather than reporting on a specific intrusion or vulnerability. The bulletin reiterates standard defensive guidance: deploy phishing-resistant MFA, maintain updated antivirus and spam filtering, train staff to recognize phishing/smishing (including AI-generated content), use SPF/DKIM to limit domain spoofing, enforce least-privilege access and strong unique passphrases, mark external emails, and keep systems patched. It directs victims to report incidents to local FBI field offices or IC3.
For defenders, the key takeaway is heightened awareness during the election cycle rather than a specific technical indicator or exploit: organizations supporting election infrastructure or political campaigns should prioritize MFA hardening, user awareness training specifically addressing AI-enhanced phishing/deepfakes, and validation of external communications through secondary channels.
Source reporting: https://www.ic3.gov/PSA/2026/PSA261016
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 614 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs