More than 5,000 malicious domains targeting the 2026 US midterm elections were detected in operation, and could be used for fraud, phishing, or worse.

Check Point Research warns that Russia and other nation-states are carrying out large-scale disinformation campaigns ahead of the US midterm elections.
Operations include phishing sites, fake donation portals and Doppelganger clones of mainstream media.
The midterm elections are scheduled for November of this year.

Russia (and probably other nation-states as well) is actively trying to influence the US midterm elections scheduled for November of this year. This is according to a new report from cybersecurity researchers Check Point Research, who said they saw more than 5,000 election-themed websites appear since January of this year.

“In this new era of AI-driven disinformation, the goal is often not to change the vote count directly, but to convince voters that the truth itself is difficult to verify,” the researchers said. In other words, these hackers are not targeting the machines that count the votes, but rather the humans who cast them, influencing them and thus changing the outcome of the elections.

This is nothing new, and we have already seen US government officials accuse Putin of meddling in the US presidential election.

double

This time, however, Check Point found concrete evidence, as well as a detailed modus operandi of these operations. In January, researchers found 1,300 domains containing the word “election” and nearly 3,000 containing the word “vote.” Between mid-April and mid-May, “choice” remained stable at around 1,140, while “vote” skyrocketed to 4,010. “The volume is increasing as November approaches and the mix is shifting toward a more voter-oriented mandate,” it was explained.

While domain registration volume alone does not automatically mean malicious intent, security teams know that domains are typically used for phishing pages posing as information portals, fake donation collection sites, candidate impersonation, and misinformation distribution campaigns.

Check Point also said it saw a Russian operation called Doppelganger cloning high-authority news sites (PakGazette, The Washington Post, Fox News and the like) and publishing fake news there, hoping other outlets would pick it up and distribute it before realizing the scam.

“Security teams working with campaigns, election organizations, fundraising platforms, or any organization adjacent to this environment should treat this cycle as a high-risk period for phishing, spoofing, and credential-based attacks,” Check Point concluded. “That’s not because the threats are new, but because the motivation and attention behind them is significantly higher than usual.”