Attackers don't need to manufacture urgency anymore. They just check the calendar.
Tax season, the FIFA World Cup, and now the November 3rd U.S. midterm elections: each fixed, high-attention event hands threat actors a ready-made pretext, a built-in deadline, and a flood of legitimate messages to hide inside. New research from Hoxhunt and Check Point shows how predictable the pattern has become, and why the election cycle may be the most potent version of it yet.
Hoxhunt's data, drawn from more than 50 million real and simulated threat reports across more than 4 million users worldwide, tell a consistent story about what it calls temporal phishing. View the report.
In spring 2026, Hoxhunt detected the largest tax-related phishing campaign in its global threat intelligence history. U.S. tax authority impersonation campaigns rose more than 400% over the baseline of the previous two years, while overall phishing volume aimed at U.S. employees climbed roughly 147% in the same period. Notably, the campaign targeted employees at work rather than consumers at home.
Hoxhunt CEO Mika Aalto has said tax phishing has increasingly shifted out of personal inboxes and into corporate environments. Personalized tax-themed simulations produced a 16% failure rate, more than three times Hoxhunt's 4–6% global average.
Then came the World Cup. Hoxhunt analysts observed a nearly 500% increase in World Cup 2026–themed attacks on employees between April and June, peaking around kickoff. That made it the most-spoofed sports or entertainment event in Hoxhunt's data, far outpacing the Paris 2024 Olympics. Lures leaned heavily on fake ticketing, hospitality packages, and sponsor promotions, including bogus Coca-Cola prize bundles.
[RELATED: How the 2026 World Cup Became the Ultimate Social Engineering Catalyst]
The common denominator shows up in Hoxhunt's simulation data: time-sensitive phishing simulations are 42% more likely to draw clicks than non-temporal ones.
"Cybercriminals can weaponize the calendar with targeted phishing messages powered by AI," said David Badanes, Cyber Evangelist & Human Risk Advisor at Hoxhunt. "They do not have to invent urgency; they borrow it from moments when people already expect unusual messages and feel pressure to act."
Elections, he argues, provide the same ingredients, "but supercharged: fixed deadlines, fundraising appeals, heightened emotions, and an extraordinary volume of communications."
Underneath the seasonal spikes sits a structural shift. Hoxhunt's 2026 Phishing Trends Report found that AI-generated phishing emails that bypassed security filters held steady at 1–4% of reported threats for months, then surged to 56% in December 2025, a fourteenfold jump, before settling to 40% in January 2026.
"We believe that now it is harder to find attacks that don't use AI than attacks that do," Badanes said.
Hoxhunt is careful not to overclaim. It has not attributed a specific share of this cycle's election messages to AI, and Badanes notes that polished content doesn't prove AI involvement, nor is AI-generated content automatically malicious. "The issue is whether it is being used for impersonation, deception, or manipulation."
Check Point's Jeremy Fuchs made a similar point to CyberScoop: the barrier to entry is lower and the quality is far higher than it was even three years ago.
The election precedent is already on the books. In 2024, the U.S. FCC fined political consultant Steve Kramer $6 million over spoofed robocalls that cloned President Biden's voice and urged New Hampshire primary voters to stay home.
Check Point's 2026 U.S. Midterm Election Threat Outlook, built on intelligence from Check Point Exposure Management, reframes where the risk actually sits. The highest-probability threats this cycle aren't about altering vote tallies. They're phishing, brand impersonation, credential theft, and domain abuse, aimed at campaigns, donors, election offices, and voters.
Check Point security architect Aaron Rose described the focus as "hacking the mind"—confusing voters enough that they stop trusting the process.
Two data points stand out.
Infrastructure is appearing fast. In January, roughly 2,957 newly-registered domains contained the word "vote." Between April 13 and May 14, that figure jumped to about 4,010, while "election" domains held steady around 1,140. Registration alone doesn't prove intent, but it expands the pool of domains available for phishing, fraudulent donations, and misinformation.
[RELATED: DNS Saw the Malware Surge Coming]
Access is already for sale. As of May 2026, Check Point tracked approximately 9,500 leaked credentials tied to ActBlue and 6,500 tied to WinRed in criminal markets, along with smaller sets tied to gop.com, democrats.org, and usa.gov. Check Point is clear that this does not indicate a breach of either fundraising platform; the credentials were exposed through other compromises. Check Point threat intelligence analyst Danielle Hess told The Register that domains and leaked credentials are two sides of the same problem: infrastructure and access.
Badanes draws the connection plainly: "Stolen credentials can turn an attacker into an apparently trusted sender.… The notification may be authentic while the person, content, or request behind it is malicious."
Here's what makes election season uniquely difficult: real political outreach often looks exactly like social engineering.
"They can arrive from an unfamiliar sender, use provocative language, predict dire consequences, and will direct voters to unfamiliar sites through shortened links," Badanes said. "A professional-looking message is not necessarily safe."
That ambiguity cuts both ways. Defenders can't teach users to spot election scams by tone, because tone isn't a reliable signal. Badanes' advice is to verify the sender, destination, and transaction, not whether the message sounds normal.
The lures themselves are familiar: a donation deadline about to expire, a registration that needs attention, a polling place that has moved, a ballot with a problem. The objective varies—from stolen money and credentials to malware and disinformation—but the mechanism doesn't.
"The motives of state-sponsored influence operations and profit-seeking criminals may differ, but their techniques overlap," Badanes said. "Impersonate a trusted source, and use that borrowed credibility to influence the target."
Check Point points to Russian-linked Doppelganger operations, which cloned Reuters, The Washington Post, and Fox News using lookalike domains convincing enough to pass casual inspection. The same impersonation infrastructure that spreads disinformation can just as easily deliver phishing lures to campaign staff, donors, or election officials.
Not every election-themed attack is the same attack. A voter-facing scam is often ordinary cybercrime wearing an election costume. An attack on campaign staff, election officials, or poll workers may be after internal communications, donor data, schedules, or operations, and depending on its purpose, can damage public trust in the process itself.
For the organizations on that second list, Badanes recommends phishing-resistant authentication, least-privilege access, monitoring for unusual account activity, and making suspicious messages easy to report.
Most SecureWorld readers aren't running campaigns. But your employees are voters, donors, and volunteers, and they're reading election messages on the same devices they use for work. The tax and World Cup data show that seasonal lures land in corporate inboxes, not just personal ones.
Run a timely awareness push. Temporal simulations draw 42% more clicks for a reason. Use that window to teach the pattern, not just the theme.
Teach "leave the message." Badanes' one habit: don't rely on the link, number, or instructions inside a message asking you to donate, confirm registration, or change your polling place. Go to Vote.gov to find official state and county election offices, and find campaigns independently.
Borrow a simple framework. Badanes points to Microsoft's "Check. Recheck. Vote." model: check the source and date, recheck against an original source, and vote based on current guidance from your state or local election website.
Watch for lookalike domains. If your brand, executives, or civic partnerships could be impersonated, monitor newly-registered domains that touch your name and election keywords.
Don't outsource the important stuff to a chatbot. "Do not entrust something as important as when and where to vote solely to a text message, search summary, or chatbot," Badanes said.
The midterms won't introduce a new class of attack. They'll concentrate the same phishing, impersonation, and credential abuse that security teams fight every day into a few high-pressure weeks, with political disruption added to the list of motives.
Attackers have learned to borrow urgency from the calendar. The defense is to borrow it back: use the moment to reinforce the one habit that works across every seasonal lure. Pause, leave the message, and verify through a channel you found yourself.