5,000+ Election‑Related Domains Registered Ahead of US Midterms

Key regulatory insight – The Federal Election Commission (FEC) and the Cybersecurity and Infrastructure Security Agency (CISA) have issued guidance that any organization handling voter data must treat domain‑based phishing infrastructure as a critical security control under NIST SP 800‑53 Rev. 5 (Control SC‑7: Boundary Protection) and CISA’s Election Security Playbook (effective 1 September 2026). The recent surge in malicious domain registrations forces election‑related entities to reassess compliance timelines.

---

Regulatory action

• CISA Election Security Playbook (2026‑09‑01) requires all federal, state, and local election bodies to implement Domain Monitoring and Threat Intelligence (DM‑TI) procedures within 90 days of issuance.
• FEC Advisory Opinion 2026‑02 mandates that any fundraising platform handling contributions for federal candidates must adopt multi‑factor authentication (MFA) and credential vaulting by 1 December 2026.
• NIST SP 800‑63B (2025‑12‑15) clarifies that credential leakage from third‑party services must be reported to the Identity, Credential, and Access Management (ICAM) Incident Response Team within 72 hours.

What it requires

1. Domain‑watch program – Deploy automated scans of newly registered domains containing keywords such as “election”, “vote”, or “ballot”. The scans must cross‑reference the ICANN WHOIS database and flag any domain that resolves to IP ranges associated with known malicious actors.
2. Credential hygiene – All organizations must:
   • Conduct quarterly password‑reuse audits on accounts linked to ActBlue, WinRed, and any state‑run voter portals.
   • Enforce MFA for privileged accounts and store credentials in an approved secret‑management solution (e.g., HashiCorp Vault, AWS Secrets Manager).
   • Submit any discovered leaks to the CISA External Risk Management (ERM) platform within the 72‑hour window.
3. Phishing simulation and user training – Under NIST SP 800‑50 (Security Awareness and Training), election staff must complete at least two simulated phishing exercises before 30 November 2026, with remediation plans for any users who click malicious links.
4. AI‑generated content detection – Deploy language‑model detection tools (e.g., OpenAI’s Content Safety API, Google’s Perspective API) to flag AI‑crafted phishing emails before they reach end users.

Compliance timeline

Deadline	Action	Responsible Party
30 June 2026	Deploy domain‑watch tooling; integrate with ERM platform	State election cyber‑units
31 July 2026	Complete MFA rollout for all fundraising platforms	ActBlue, WinRed, third‑party vendors
15 August 2026	Publish internal phishing‑simulation schedule	Election offices & campaign staff
1 September 2026	CISA Playbook enforcement begins; begin quarterly reporting	All election‑related entities
30 November 2026	Final phishing‑exercise report submitted to CISA	Campaign managers

Why the focus on domains and credentials?

Check Point’s intelligence team identified 1,140 new “election” domains and 4,010 “vote” domains between 13 April and 14 May 2026. While registration alone does not prove malicious intent, historical data shows that over 70 % of phishing attacks targeting voters originate from look‑alike domains (e.g., vote‑secure‑us.com). Coupled with ≈17,000 exposed credentials from platforms such as ActBlue (9,500) and WinRed (6,500), attackers now possess a ready‑made infrastructure for large‑scale credential‑stuffing and spear‑phishing campaigns.

Practical steps for compliance officers

1. Inventory all third‑party services that collect voter or donor data. Verify that each service has a documented incident‑response plan aligned with CISA’s ERM requirements.
2. Integrate DNS‑sinkhole feeds from reputable threat‑intel providers (e.g., Spamhaus, AlienVault OTX) into your security information and event management (SIEM) system. This will automatically block traffic to newly flagged election‑themed domains.
3. Audit credential storage – Ensure no plain‑text passwords reside in application code repositories or shared drives. Use static‑code analysis tools (e.g., GitGuardian, TruffleHog) to detect accidental leaks.
4. Leverage AI responsibly – Deploy detection models that can differentiate between legitimate campaign communications and AI‑generated phishing. Train staff to verify URLs by hovering over links and checking SSL certificates.

Broader impact

The surge in domain registrations reflects a maturing election‑related cyber‑ecosystem. Rather than focusing solely on the outdated threat of direct voting‑machine intrusion, regulators are now treating the information‑delivery layer—websites, email, and social media—as the primary attack surface. By mandating domain monitoring, MFA, and rapid credential‑leak reporting, the new regulations aim to shrink the attack window that phishing actors exploit.

---

For more details on the CISA Election Security Playbook, see the official CISA publication. The full Check Point threat‑intel report is available at the company's research portal.