Election Season Is Phishing Season — And Attackers Know It
A text says your polling location has changed. An email says your donation will be matched, but only until midnight. A phone call, in a voice that sounds just like the president’s, tells you to sit this election out. Some messages like these are real. Some are not, and in election season it is getting harder to tell which is which.
Cybercriminals are counting on that confusion. They can weaponize the calendar with targeted phishing powered by AI, and they don’t have to invent urgency to do it. They borrow it from a season already packed with deadlines, constant fundraising, heightened emotions and an extraordinary amount of political outreach, when people expect unusual messages and feel pressure to act. The calendar tells them when to strike, and trust does the rest.
The Calendar Is the Attack Surface
Attackers have capitalized on these seasonal moments before and research from Hoxhunt and Check Point captures the impact. Hoxhunt has found that time-sensitive phishing simulations were 42% more likely to draw clicks, along with a nearly 500% increase in World Cup-themed phishing attacks and a 400% increase in U.S. tax-authority impersonation campaigns during tax season. Check Point has identified election-specific web infrastructure growth: approximately 4,010 domains containing “vote” were registered between April 13 and May 14, compared with roughly 2,957 in January. Domain registration does not prove malicious intent, but it shows how rapidly infrastructure can appear around a predictable, high-attention event.
Election Day combines deadline pressure, intense emotions and an enormous amount of legitimate messages asking people to act quickly. That sheer volume gives malicious messages more places to hide and more masks to wear.
What Does It Look Like?
Politics create a tricky cybersecurity environment because legitimate messages often resemble social engineering scams. A valid message can arrive from an unfamiliar sender, use provocative language, predict dire consequences, and direct voters to unfamiliar sites through shortened links. Additionally, while an unusual message requesting voters to donate is technically legal, a polished, professional note can easily be a sophisticated scam.
The election theme is the pretext. The objective could be stealing money, capturing credentials, spreading malware or manipulating what voters believe through disinformation. A message might claim that a donation deadline is expiring, a registration requires attention, a polling location has changed or a ballot has encountered a problem.
The motives of state-sponsored influence operations and profit-seeking criminals may differ, but their techniques overlap: impersonate a trusted source and use that borrowed credibility to influence the target. Check Point reports that Russian-linked Doppelganger operations have cloned Reuters, The Washington Post and Fox News using lookalike domains, fake personas, AI-assisted content and paid amplification. The same impersonation infrastructure can spread disinformation, deliver phishing lures or target campaign staff, donors and election officials. The common mechanism is the abuse of trust.
AI Makes Attacks Easier and Cheaper
AI-enabled election manipulation is no longer hypothetical. In 2024, the FCC fined political consultant Steve Kramer $6 million for orchestrating illegal spoofed robocalls that cloned President Biden’s voice and urged New Hampshire Democratic party members not to vote. Kramer had worked for a rival Democratic primary campaign, which denied knowledge of the scheme.
Since then, Hoxhunt has observed the broader threat landscape finding phishing attacks with indicators of AI assistance increasing fourteenfold at the end of 2025, rising from under 5% to 56% of reported attacks in one month. In fact, it is now harder to find attacks that don’t use AI than attacks that do. AI helps attackers produce polished, localized content across email, text, audio and video. But polished content does not prove that AI was used, and AI-generated content is not automatically malicious. The issue is whether it is being used for impersonation, deception or manipulation.
What Voters Can Do Now
If a message creates urgency or a strong emotional reaction, pause before engaging with it. For information on where to find your state or county election office, use Vote.gov. For donations, locate the campaign or organization independently rather than trusting the message’s link. Verify the sender, destination and transaction, not whether the political message sounds normal.
Microsoft’s Microsoft’s “Check. Recheck. Vote.” framework is useful: check the source and date, recheck important information against an original source, and vote based on current guidance from your state or local election website. Vote.gov can direct you to the appropriate official resource. Do not rely solely on a text message, search summary, or chatbot for critical details like when and where to vote.
But before you do anything, close the message before taking the action. Do not rely on the link, number or instructions supplied by a message asking you to donate, confirm your registration or change your polling location.
Trust is what makes an election work and also what makes a scam work. You can keep it from being used against you with one habit: verify first, then act.
