Defending election and campaign officials against cyber threat actors

What the October 16, 2026 announcement says

CISA's page, published October 16, 2026, says CISA and the FBI released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections. This guide works from that summary page and from one second CISA advisory. It does not have the text of the PSA itself. Anything the PSA lists beyond the summary is therefore outside what can be reported here, and the sections below say plainly where the documents stop.

The techniques CISA names

The summary page is specific about the method. CISA says malicious cyber actors may use phishing and smishing techniques to steal login credentials and other sensitive information or install malware on targeted devices.

The page also describes a change in quality. CISA says cyber actors are increasingly using sophisticated phishing and smishing campaigns that closely resemble legitimate communications.

The page lists the formats. According to CISA, these efforts may include convincing emails, text messages, audio, and video content designed to manipulate recipients into disclosing sensitive information or interacting with malicious links and attachments.

That is the full list of techniques on the page. It does not name specific threat groups, malware families, vulnerabilities or indicators of compromise. A team looking for those will not find them in this summary.

Why these targets draw attention

CISA gives its reasons for the interest in this group. The page says election officials, candidates, and political organizations may be attractive targets because of their access to voter registration data, current government officials, and sensitive campaign information.

The reasons concern what these people can reach. The page ties the risk to access, not to the size or type of the organization. This is how CISA frames it, and the page does not rank which of the three kinds of access matters most.

What CISA asks of officials and campaign staff

The request on the page is brief. CISA and the FBI urge election officials, campaign personnel, and the public to review the PSA, follow recommended cybersecurity practices, and remain vigilant for suspicious emails and mobile messages.

Two points follow from the wording. The page directs readers to the PSA for the recommended practices and does not repeat them. The page also addresses the people who receive the messages, not only their IT staff. Detection guidance written for security teams is not on this page.

Related CISA guidance on defending against intrusions

A second CISA document gives concrete defensive steps, with a limit. It is the #StopRansomware advisory on SafePay ransomware, alert code AA26-293A, released on October 20, 2026. It is not an election document, and it does not say SafePay targets election or campaign officials. Treat the steps below as CISA's general recommendations for organizations. They are not election-specific instructions.

The advisory's intended audience includes government and State, Local, Tribal, and Territorial (SLTT) organizations, which is where many election offices sit.

It overlaps with the election page on one point. The advisory says SafePay actors typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics. The advisory states that the group has impacted at least 600 separate victims from multiple critical infrastructure sectors.

Reducing risk: what the advisory recommends

Because stolen credentials are the common thread, the account controls come first. The advisory tells organizations to implement identity, credential, and access management policies and to require MFA for all services to the greatest extent possible, particularly for webmail, VPNs, and accounts that access critical systems.

For email-borne lures, the advisory says organizations should consider adding an email banner to emails received from outside of your organization.

For backups, the advisory says to maintain offline backups of data and to regularly test and maintain backup and restoration processes.

Detecting activity and responding

On detection, the advisory says to identify, detect, and investigate abnormal activity and potential traversal of the indicated ransomware with a network monitoring tool. It adds that Endpoint Detection and Response (EDR) tools are particularly useful for detecting lateral connections because they have insight into common and uncommon network connections for each host.

The advisory also tells teams to review domain controllers, servers, workstations, and Active Directories for new, unactive, or unrecognized accounts.

If a compromise is found before encryption, the advisory says to determine which hosts were compromised and isolate them by quarantining or taking them offline.

The authoring agencies also recommend testing controls against the attacker behavior in the advisory. They recommend exercising, testing, and validating your organization's security program against the threat behaviors mapped to the MITRE ATT&CK framework.

What the documents do not cover

The election page contains no technical detail on how to spot a smishing text or a convincing audio or video lure. It does not describe tooling for protecting personal devices or campaign accounts, and it does not say how election offices should coordinate with CISA or the FBI beyond urging review of the PSA. The SafePay advisory is written for ransomware defense, so its indicators of compromise and tool lists should not be read as markers of election-related phishing.

A security team supporting election or campaign staff should read the full PSA that CISA and the FBI released, because the election-specific recommended practices are in that document and not in the two documents used here. The SafePay advisory can inform general account, email, backup and monitoring controls in the meantime, with the limits stated above.