Defending election and campaign officials against phishing and account takeover

What the two documents cover, and where they stop

This guide draws on two CISA documents. Each answers part of the question, and neither answers all of it. Readers should know the limits before acting on anything below.

The first is a CISA web page that summarizes a public notice on election threats. CISA's page carries the label "Publish Date October 16, 2026 PUBLIC SERVICE ANNOUNCEMENT". It is a short summary. The full PSA text and its recommended practices are not among the documents supplied for this guide. So the specific controls CISA and the FBI recommend to election and campaign staff cannot be quoted here.

The second is a joint ransomware advisory about the SafePay group. CISA's advisory is listed as "Release Date October 20, 2026 Alert Code AA26-293A". That advisory is not about elections, and it does not mention election officials or campaigns. Where this guide describes its controls, they are CISA's recommendations for organizations in general. They are not guidance written for politically exposed users. Treat the second half of this guide with that in mind.

What CISA says threat actors are doing to election and campaign officials

CISA's page says it and the FBI released a PSA about the 2026 midterm elections. CISA's page states: "CISA and the Federal Bureau of Investigation (FBI) released a Public Service Announcement (PSA) warning election and campaign officials about cyber threats during the 2026 U.S. midterm elections."

The page names two main techniques, phishing and smishing. Smishing is phishing carried out by text message. CISA's page says malicious actors "may use phishing and smishing techniques to steal login credentials and other sensitive information or install malware on targeted devices." That sentence names three goals: stolen logins, stolen sensitive information, and malware on devices.

CISA also describes how convincing the lures are. The page says cyber actors "are increasingly using sophisticated phishing and smishing campaigns that closely resemble legitimate communications." The lures are not limited to email. CISA's page says these efforts may include "convincing emails, text messages, audio, and video content designed to manipulate recipients into disclosing sensitive information" and also into interacting with malicious links and attachments.

Why these users draw attention

CISA gives a reason for the targeting. It says election officials, candidates, and political organizations "may be attractive targets because of their access to voter registration data, current government officials, and sensitive campaign information."

That sentence matters for scoping. The access these users hold is the reason they are targeted. A security leader building a high-risk user group should look at what access each person holds. Job title alone is not enough.

CISA's page asks one thing of the people involved. It says CISA and the FBI "urge election officials, campaign personnel, and the public to review the PSA, follow recommended cybersecurity practices, and remain vigilant for suspicious emails and mobile messages." The page does not list those practices itself. It points to the PSA for them.

How phishing turns into account takeover

The election page stops at the phishing step. The SafePay advisory describes what can follow once credentials are stolen. It is a ransomware advisory, so the specifics are not election-specific. Still, the account-takeover path it describes is the one a stolen login opens.

The advisory's summary says SafePay actors "typically gain access to networks by stealing or guessing passwords, exploiting vulnerabilities in security systems, and using phishing tactics." The technical section ties phishing to the later steps. It says SafePay actors "use phished account profiles to access victim networks to exploit the following known Common Vulnerabilities and Exposures (CVEs) for edge device products".

Persistence works through accounts. The advisory says: "Once inside the network, SafePay actors establish control by creating new accounts or taking over existing ones." A phished login is therefore a starting point, and the account itself is part of what the actor wants to hold.

Account controls the SafePay advisory recommends

The advisory's mitigations section is a general list for organizations. These are the items most relevant to account security, quoted from CISA's wording.

On multifactor authentication, the advisory says to implement identity, credential, and access management (ICAM) policies and to "require MFA for all services to the greatest extent possible,particularly for webmail, VPNs, and accounts that access critical systems". Webmail is on that list. It is also the channel CISA's election page names for phishing.

On passwords, the advisory gives a length rule: "Use longer passwords consisting of at least 15 characters and no more than 64 characters in length." It also says to avoid frequent forced resets. A note in the advisory says that "Frequent password resets are more likely to result in users developing password patterns cyber threat actors can easily decipher."

On guessing attacks, the advisory lists account lockouts. Its wording is: "Implement multiple failed login attempt account lockouts [ CPG 3.E ]."

On privileged accounts, the advisory says to "Audit user accounts with administrative privileges and configure access controls according to the principle of least privilege [ CPG 3.G ]."

Patching and detection

The advisory ties patching to the exposure of edge systems. It says to "Prioritize remediating known exploited vulnerabilities (KEVs) and keep all operating systems, software, and firmware up to date". This control applies to the organization's systems, not to any one user. It still affects the same attack path, because the advisory names edge device vulnerabilities as targets for actors using phished accounts.

For detection, the advisory says to review accounts for ones that should not exist. Its wording is: "Review domain controllers, servers, workstations, and Active Directories for new, unactive and/or unrecognized accounts." This check addresses the account-creation behavior described earlier.

The advisory also covers tooling. It says "Endpoint Detection and Response (EDR) tools are particularly useful for detecting lateral connections as they have insight into common and uncommon network connections for each host."

What a security leader can take from this

Two things are supported directly by the documents. First, CISA says the threat to election and campaign officials is phishing and smishing aimed at logins, data, and devices, with lures that may include text, audio, and video. Second, CISA's SafePay advisory gives a set of account controls: MFA on webmail, VPNs, and critical-access accounts, long passwords, lockouts, least-privilege audits, patching of known exploited vulnerabilities, and account and network monitoring.

Two things are not supported. The documents do not give a control set designed for politically exposed users. They also do not say that SafePay is targeting election or campaign staff. A leader who wants CISA's own election-specific recommendations should read the full PSA that CISA's page refers to, because that text was not part of the material used here.