Election-Week Phishing: When the News Is the Bait

Big news events give phishing something hard to fake otherwise: a reason people expect to hear from someone. This post is nonpartisan. It is about staff behavior and account response, not politics, and it makes no claims about any specific actor or campaign.

Why a news event makes a good pretext

Around an election, messages about donations, voter-registration checks, poll-worker notices and official-looking alerts can feel routine. Phishing lures commonly combine urgency with borrowed authority, and a major news event can supply both. The message says something important is happening, and it appears to come from someone who should be trusted.

The same pattern shows up around tax deadlines, natural disasters and big sporting events. The topic changes. The pressure to click quickly is what stays familiar.

A staff rule of thumb

Do not act on unexpected texts or emails. Reach the organization through a channel you already trust instead:

• Type the website address yourself, or use a bookmark you saved earlier.
• Use a phone number from a statement, a card or the official site, not from the message.
• Open the app you already use rather than the link you were sent.

Consumer guidance from the FTC on unexpected text messages points the same way: treat the unsolicited message as a prompt to check independently, not as an instruction. Staff do not need to judge whether a message is convincing. They only need to refuse to let the message set the terms.

Reporting beats embarrassment

The most useful habit you can build is a fast, no-blame way to say “I clicked.” People hide mistakes when they expect to be punished, and a hidden click gives an attacker more time with a live session.

Make it easy:

• Give staff one reporting button or one shared mailbox.
• Say out loud that reporting quickly is the correct behavior, even when the click was a mistake.
• Thank the person who reports. Do not single them out.

A report that arrives within minutes is often the difference between a password reset and a full account investigation.

What responders do next

If someone entered credentials or approved a prompt, treat the account as compromised until shown otherwise. Microsoft’s guidance on responding to a compromised email account is a good baseline. In practice the steps look like this:

1. Reset the password from a trusted device.

2. Revoke active sessions and refresh tokens so existing sign-ins stop working.

3. Review MFA methods and remove any you do not recognize. Attackers commonly add their own.

4. Check inbox rules and forwarding settings for rules that hide, move or forward mail.

5. Review OAuth app consents and remove unfamiliar apps, since a malicious app can keep access after a password change.

6. Review sent items and sign-in activity to understand what the account was used for.

Containment starts as soon as the problem is understood. Evidence capture, such as exporting sign-in logs and rule details, happens in parallel and is not a reason to wait.

Admins: find the same lure everywhere

One reported message usually means others received it. While the first user is being handled:

• Search mailboxes for the same sender, subject line and link domain.
• Quarantine or purge matching messages that are still unread.
• Block the sender and the link at your mail filter and web filter.
• Look at sign-in logs for users who received the lure, and watch for new MFA registrations or new inbox rules afterward.
• Tell staff what you found in plain language, so the next person who sees it reports it.

This is where a BEC investigation often starts: the first phish is the visible part, and the mailbox rule or consent grant behind it is what keeps the access alive.

Where to point staff

CISA publishes its election-related resources under its election security topic, and it also offers general awareness material during Cybersecurity Awareness Month. Both are reasonable places to send staff who want a trustworthy reference.

A short checklist for this week

• Remind staff of the rule: unexpected message, independent channel.
• Confirm that everyone knows how to report a click, and that reporting is blame-free.
• Write down your reset, revoke and rule-check steps so they are not improvised under pressure.
• Make sure someone can search and purge across mailboxes quickly.

If you want a second set of eyes on how your team would handle a compromised mailbox, see our BEC and M365 investigation and incident response pages, or reach us through the contact page.

Message us to talk through your phishing response plan.