Will AI-native language scams fool 2026 election staff via encrypted apps?
FBI and CISA warn that super intelligence enables sophisticated phishing and smishing campaigns against US election staff and candidates.
Key points
- FBI and CISA issue PSA on AI-enhanced threats to 2026 midterm election officials
- Super intelligence allows threat actors to craft native-language phishing messages
- Smishing attempts via encrypted chat applications increased in recent months
The short version
- Election officials and candidates face heightened risk from AI-generated fraud
- Threat actors use super intelligence to bypass traditional grammar-based detection
- Encrypted messaging apps are increasingly used for smishing campaigns
The details
The Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency issued a joint public service announcement regarding cyber threats to US election and campaign officials ahead of the 2026 midterms. According to the advisory, malicious actors are leveraging phishing and smishing techniques to steal login credentials and sensitive campaign data. These targets are attractive due to their access to voter registration records and private government communications.
Super intelligence tools enable threat actors to generate large-scale, highly effective phishing campaigns with native language proficiency. This eliminates traditional indicators such as spelling errors or poor grammar, making fraudulent messages difficult to distinguish from legitimate correspondence. The FBI noted that adversaries also use super intelligence to create convincing deepfake video and audio recordings to bolster these schemes.
The context
Historically, phishing emails were identifiable by illogical vocabulary and grammatical mistakes. The integration of super intelligence allows criminals to produce genuine-sounding content that increases the likelihood of victims clicking malicious links or disclosing information. The FBI observed a surge in phishing attempts during recent election cycles, with a specific increase in smishing via encrypted chat applications over the last year.
Next steps
The agencies urge officials to critically evaluate the source of all emails and mobile messages. Organisations should implement phishing-resistant multi-factor authentication for email, virtual private networks, and critical system accounts. Security teams are advised to examine content for credentials or watermarking indicating super intelligence generation. Keeping antivirus and anti-malware software updated is also essential to detect inbound malware and sophisticated campaigns.
What defenders should look for
Teams should monitor for unusual login patterns and verify unexpected requests for credentials via secondary channels. Check email headers and message metadata for anomalies, even if the text appears grammatically perfect. Look for subtle inconsistencies in deepfake media, such as unnatural eye movements or audio artefacts. Contain compromised accounts immediately by resetting credentials and revoking active sessions. Review firewall logs for connections to unknown IP addresses and isolate affected endpoints to prevent lateral movement.
Background: Threat actors
Threat actors are individuals or groups who initiate cyber attacks. They range from lone hackers to state-sponsored organisations. Understanding their motives helps you predict behaviour. You must monitor for anomalies, not just known signatures, to detect their presence before data exfiltration occurs.
Read the full guide: What Is Threat Actors: Definitions, Tactics and Detection Strategies
What to do and how to stay safe: FBI
- Enforce phishing-resistant multi-factor authentication on all critical accounts and remote access services
- Verify the authenticity of urgent requests through established out-of-band communication methods
- Train staff to recognise super intelligence-generated content by checking for digital watermarks or credentials
- Ensure endpoint protection software is updated to detect modern phishing and malware variants
Step-by-step guide: Password Manager Security Checklist: Hardening Your Vault
General security guidance from the Honeypot Daily newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why are 2026 election officials targeted?
They have access to sensitive voter registration data, current government officials, and private campaign information.
How does super intelligence change phishing attacks?
It allows actors to create native-language, grammatically correct messages and realistic deepfakes that bypass traditional detection.
What new smishing trend did the FBI note?
An increase in smishing attempts delivered through encrypted chat applications over the last year.
