CISA and the FBI have issued a Public Service Announcement warning election officials, candidates and political organizations to expect phishing and smishing attempts during the 2026 U.S. midterms. Smishing is phishing by text message.
This is a routine advisory. The announcement describes no new breach and names no specific campaign or attacker. It is a general warning about methods.
The agencies said malicious cyber actors may use these techniques to steal login credentials and other sensitive information, or to install malware on a targeted device. They gave three reasons these groups are attractive targets: access to voter registration data, access to current government officials, and access to sensitive campaign information.
The notable detail is polish. The agencies said attackers are increasingly running sophisticated campaigns that closely resemble legitimate communications. These can include convincing emails and text messages, plus audio and video content, all designed to push recipients into handing over information or opening malicious links and attachments.
Phishing is an old problem for campaigns. The 2016 compromise of Democratic party and campaign email accounts remains the best-known example, and it began with the same basic trick of a message that looked like it belonged. What the agencies describe now is a wider toolkit, where a fake can arrive as a voice or a video as well as a typed message.
The agencies' advice is to review the PSA, follow recommended cybersecurity practices and stay alert to suspicious emails and mobile messages. Vigilance asks a lot of busy staff when the lure is built to pass for the real thing, which makes the practices in the full PSA the part worth reading closely.