Technology

Over 5,000 malicious domains targeting 2026 US Midterm elections spotted going live – and they could be used for fraud, phishing, or worse

2026-06-02 19:00
989 views
Over 5,000 malicious domains targeting 2026 US Midterm elections spotted going live – and they could be used for fraud, phishing, or worse

Malicious actors are not targeting vote counters, but rather the voters themselves.

  1. Pro
  2. Security
Over 5,000 malicious domains targeting 2026 US Midterm elections spotted going live – and they could be used for fraud, phishing, or worse News By Sead Fadilpašić published 2 June 2026

As elections get closer, the number of fake sites grows

When you purchase through links on our site, we may earn an affiliate commission. Here’s how it works.

(Image credit: Pexels)
  • Copy link
  • Facebook
  • X
  • Whatsapp
  • Reddit
  • Pinterest
  • Flipboard
  • Threads
  • Email
Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter
  • Check Point Research warns Russia and other nation‑states are running large‑scale disinformation campaigns ahead of the US midterms
  • Operations include phishing sites, fake donation portals, and Doppelganger clones of major outlets
  • Midterm elections are scheduled for November this year

Russia (and probably other nation-states, as well) is actively trying to influence US Midterm elections scheduled to take place in November this year. This is according to a new report from cybersecurity researchers Check Point Research, who said they saw more than 5,000 election-themed websites pop up since January this year.

“In this new era of AI-powered disinformation, the goal is often not to change vote counts directly, but to convince voters that truth itself is difficult to verify,” the researchers said. In other words, these hackers are not targeting the machines that count the votes, but rather humans casting them, influencing them and thus changing the outcome of the elections.

This is hardly a new thing, and we’ve seen US government officials accusing Putin of meddling with US presidential elections before.

Latest Videos FromWatch full video here: You may like
  • Cyber-security 'Cybercriminals are industrializing deception': new report reveals how major global cybercrime syndicates have infiltrated trusted domains with millions now at risk - here's what you need to know
  • Man in a business suit with pixellated face agains background of political room New report claims Trump is the most-deepfaked US politicans with over half of cases — these 3 political figures drive 74% of all threats
  • A zoomed-in picture of a computer screen displaying a login window with a password typed in Microsoft flags major phishing campaign targeting 35,000 users across 26 countries

Doppelganger

This time, however, Check Point found concrete evidence, as well as a detailed modus operandi of these operations. In January, the researchers found 1,300 domains containing the word “election” and almost 3,000 with the word “vote”. Between mid-April and mid-May, “election” held steady at around 1,140, while “vote” spiked to 4,010. “The volume is increasing as November approaches, and the mix is shifting toward the more voter-facing term,” it was explained.

While domain registration volume alone does not automatically mean malicious intent, security teams know that the domains are usually used for phishing pages impersonating information portals, fake donation collection sites, candidate impersonation, and misinformation distribution campaigns.

Check Point also said that it saw a Russian operation called Doppelganger cloning high-authority news sites (Reuters, The Washington Post, Fox News, and similar) and publishing fake news there, hoping other outlets would pick up and distribute it before realizing the scam.

“Security teams working with campaigns, election organizations, fundraising platforms, or any organization adjacent to this environment should treat this cycle as an elevated-risk period for phishing, brand impersonation, and credential-based attacks,” Check Point concluded. “That’s not because the threats are novel, but because the motivation and attention behind them are significantly higher than usual.”

Are you a pro? Subscribe to our newsletterContact me with news and offers from other Future brandsReceive email from us on behalf of our trusted partners or sponsorsBy submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over.Best antivirus software headerThe best antivirus for all budgetsOur top picks, based on real-world testing and comparisons

➡️ Read our full guide to the best antivirus1. Best overall:Bitdefender Total Security2. Best for families:Norton 360 with LifeLock3. Best for mobile:McAfee Mobile Security

Google logo on a black background next to text reading 'Click to follow TechRadar'

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

CATEGORIES Cyber Security Computing Security Computing Sead FadilpašićSocial Links Navigation

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

View More

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.

Logout Read more Cyber-security Security 'Cybercriminals are industrializing deception': new report reveals how major global cybercrime syndicates have infiltrated trusted domains with millions now at risk - here's what you need to know    Man in a business suit with pixellated face agains background of political room Security New report claims Trump is the most-deepfaked US politicans with over half of cases — these 3 political figures drive 74% of all threats    A zoomed-in picture of a computer screen displaying a login window with a password typed in Security Microsoft flags major phishing campaign targeting 35,000 users across 26 countries    Woman shocked by online scam, holding her credit card outside Security New study warns over half of Americans hit by fraud in 2025    A smartphone on a table showing the Signal app Security Signal is being targeted by Russian hackers in a huge new phishing campaign, FBI says    Digital image of a lock. Security Russian hackers hitting TP-Link home routers to hijack internet traffic    Latest in Security Paper width word VPN and hands on laptop keyboard Security Rapid7 observes new Palo Alto VPN flaw exploited in the wild to bypass GlobalProtect authentication    Digital crime by an anonymous hacker Security Compromised Red Hat npm packages downloaded over 80,000 times in one week – supply chain attack still ongoing    A hand about to touch a phone. Superimposed on top of it is a pink triangle with exclamation mark inside it. Behind it is a computer display with code on it Security Ransomware groups grow revenue by almost 40% in Q1 2026    A pink triangle with a red exclamation mark inside on a blue digital landscape Security Thousands of compromised websites abused by DriveSurge in active ClickFix and FakeUpdates campaigns    Codex remote control in ChatGPT Security OpenAI Codex tool with over 29,000 downloads linked to malicious npm supply chain attack stealing authentication tokens    The best open source software: Linux Security Multiple Linux distros hit by major 'CIFSwitch' flaw that gives attackers root access    Latest in News Microsoft Build 2026 Pro Microsoft’s Project Solara looks to break AI out of the PC and into the real world    Microsoft Build 2026 Pro Microsoft CEO Satya Nadella looks to allay fears over data center energy and water use    Microsoft Build 2026 Pro “AI is now useful”: Nvidia CEO Jensen Huang thinks a new era for AI is here    Mark Zuckerberg Pro How a former Facebook whistleblower is being silenced 'regardless of whether what she says is true'    Runna app being used on track Health & Fitness Want a Runna membership for free? All you have to do to get 2 weeks free is log a 5k on Strava on June 3    Nym logo VPN Services Decentralized NymVPN rolls out post-quantum protections as standard alongside a massive redesign    LATEST ARTICLES