Security News > 2022 > March > FBI warns election officials of credential phishing attacks
"As of October 2021, US election officials in at least nine states received invoice-themed phishing emails containing links to websites intended to steal login credentials."
On 5 October 2021, unidentified cyber actors targeted US election officials in at least nine states, and representatives of the National Association of Secretaries of State, with phishing emails.
On 18 October 2021, cyber actors used two email addresses, purportedly from US businesses, to send phishing emails to county election employees.
On 19 October 2021, cyber actors used an email address, purportedly from a US business, to send a phishing email containing fake invoices to an election official.
The US federal law enforcement agency believes the threat actors behind this phishing campaign will likely continue or increase attacks against US election officials with new phishing emails as the 2022 midterm elections are closing in.
Network defenders are advised to educate email users such as the election officials targeted in these attacks on how to identify phishing, social engineering, and spoofing attempts and always confirm requests for sensitive info-including credentials-through secondary channels.
News URL
Related news
- Phishing platform 'Lucid' behind wave of iOS, Android SMS attacks (source)
- Australian pension funds hit by wave of credential stuffing attacks (source)
- CISA and FBI Warn Fast Flux is Powering Resilient Malware, C2, and Phishing Networks (source)
- Phishing kits now vet victims in real-time before stealing credentials (source)
- iOS devices face twice the phishing attacks of Android (source)
- Phishing Campaigns Use Real-Time Checks to Validate Victim Emails Before Credential Theft (source)
- Windows NTLM hash leak flaw exploited in phishing attacks on governments (source)
- CVE-2025-24054 Under Active Attack—Steals NTLM Credentials on File Download (source)
- Three Reasons Why the Browser is Best for Stopping Phishing Attacks (source)
- Phishing detection is broken: Why most attacks feel like a zero day (source)