The FBI and CISA published a joint public service announcement, alert I-101626-PSA, warning that malicious cyber actors may try to disrupt the 2026 U.S. midterm elections using phishing and smishing to steal login credentials and sensitive data. Election officials, candidates and their political organizations are attractive targets because of their access to voter registration data and confidential campaign information. The agencies say election officials experienced a surge of phishing attempts during the last two election cycles, and that within the last year the FBI saw an increase in smishing attempts through encrypted chat applications.
The typos are gone
The most striking part of the announcement is what it says about AI. Historically, phishing emails were recognizable by spelling errors, illogical vocabulary and poor grammar. The agencies say attackers now use AI to generate language that appears genuine, written in native languages and common vernacular, which makes victims more likely to click malicious links or hand over information directly. The same technology is used to produce convincing deepfake video and audio, which criminals use to create fake identities, impersonate real people and strengthen phishing schemes. The old advice of looking for sloppy writing no longer protects anyone.
What the agencies recommend
The PSA lists concrete defensive measures for organizations. Phishing-resistant multi-factor authentication, strong spam filters, blocking emails with executable attachments, external banners on inbound mail, employee reporting processes, least privilege access and timely patching. Buried in that list is the recommendation that matters most to anyone who owns a sending domain: implement and use the Sender Policy Framework and DomainKeys Identified Mail standards to limit spoofing of the organization’s servers and domain name for use in phishing emails.
That recommendation deserves attention. SPF and DKIM are the two foundation protocols that DMARC builds on, and DMARC is the layer that actually tells receiving servers what to do when a message fails them. The FBI and CISA are effectively telling every organization that domain spoofing is a primary attack vector and that email authentication is part of basic defense, not an optional extra for large enterprises.
Why this applies to your domain
If attackers are generating flawless, native-language phishing at scale with AI, recipients cannot rely on spotting bad grammar anymore. The only reliable technical signal left is whether the message genuinely comes from the domain in the From header. SPF and DKIM provide that proof, and a DMARC policy at quarantine or reject enforces it, so nobody can borrow your domain to lend credibility to a credential theft attempt.
This is equally important for legitimate senders. Marketing and transactional email only works when the authentication chain is complete and aligned, and mailbox providers treat unauthenticated mail with growing suspicion. An organization that publishes SPF and DKIM but never advances beyond p=none is checking the box without closing the door, and its customers still have no way to distinguish a forged message from the real thing.
Election season raises the stakes for impersonation, but the threat does not end in November. Excello Mail maps every legitimate sending source for your domains and takes you to full DMARC enforcement without breaking real mail. Sign up for free to Excello Mail and make sure your domain never becomes someone else’s disguise.