Over 5,000 Malicious Domains Targeting 2026 US Midterm Elections Spotted – And They May Be Used for Fraud, Phishing, or Worse

Check Point Research Warns Russia and Other Nation States Running Large-Scale Disinformation Campaigns Ahead of US Midterms
Operations include phishing websites, fake donation portals and look-alike clones of major businesses
Mid-term elections are planned for November this year

Russia (and probably other nation-states as well) is actively trying to influence the US mid-term elections scheduled for November of this year. This is according to a new report from cyber security researchers Check Point Research, who said they saw more than 5,000 election-themed websites appear since January of this year.

“In this new era of AI-driven disinformation, the goal is often not to change vote numbers directly, but to convince voters that truth itself is difficult to verify,” the researchers said. In other words, these hackers are not targeting the machines that count the votes, but rather the people who cast them, influence them and thus change the outcome of the election.

This is hardly new, and we have seen US government officials accuse Putin of meddling in the US presidential election before.

Doubles

This time, however, Check Point found concrete evidence as well as a detailed modus operandi for these operations. In January, the researchers found 1,300 domains containing the word “election” and nearly 3,000 with the word “vote”. Between mid-April and mid-May, the “election” held steady at around 1,140, while the “vote” increased to 4,010. “Volume increases as November approaches and the mix shifts towards the more voter-facing period,” it explained.

While domain registration volume alone does not automatically mean malicious intent, security teams know that the domains are commonly used for phishing sites that impersonate information portals, fake donation collection sites, candidate impersonation, and disinformation distribution campaigns.

Check Point also said it saw a Russian operation called Doppelganger that cloned high-authority news sites (Pakinomist, The Washington Post, Fox News and the like) and published fake news there, hoping other outlets would pick up and distribute it before realizing the scam.

“Security teams working with campaigns, election organizations, fundraising platforms, or any organization adjacent to this environment should treat this cycle as an elevated risk period for phishing, impersonation, and credential-based attacks,” Check Point concluded. “It is not because the threats are new, but because the motivation and attention behind them is significantly higher than usual.”