More than 5,000 malicious domains targeting the 2026 US midterm elections have been spotted and could be used for fraud, phishing or worse.

Check Point Research warns that Russia and other nation states are waging large-scale disinformation campaigns in the run-up to the U.S. midterm elections.
Operations include phishing sites, fake donation portals and Doppelganger clones of major media outlets.
Midterm elections are scheduled for November this year

Russia (and likely other nation states as well) is actively trying to influence the US midterm elections scheduled for November this year. That’s according to a new report from cybersecurity researchers Check Point Research, who said they’ve seen more than 5,000 election-themed websites pop up since January of this year.

“In this new era of AI-powered disinformation, the goal is often not to directly change the vote count, but to convince voters that the truth itself is difficult to verify,” the researchers said. In other words, these hackers are not targeting the machines that count the votes, but rather the humans who vote on them, influence them and thus change the outcome of the elections.

This is not a new thing, and we have already seen U.S. government officials accuse Putin of interfering in the U.S. presidential election.

Lookalike

This time, however, Check Point found concrete evidence, as well as a detailed modus operandi of these operations. In January, researchers found 1,300 domains containing the word “election” and nearly 3,000 with the word “vote.” Between mid-April and mid-May, the number of “elections” remained stable at around 1,140, while the “voting” increased to 4,010. “The volume increases as November approaches, and the composition shifts towards more voter-oriented mandates,” it was explained.

Although the volume of domain registrations does not automatically mean malicious intent, security teams know that domains are commonly used for phishing pages impersonating news portals, fake fundraising sites, candidate impersonations, and disinformation campaigns.

Check Point also said it saw a Russian operation called Doppelganger cloning high-authority news sites (PK Press Club, The Washington Post, Fox News, etc.) and publishing fake news there, in the hopes that other media outlets would pick it up and spread it before realizing the scam.

“Security teams working with campaigns, election organizations, fundraising platforms, or any organization adjacent to this environment should treat this cycle as a high-risk period for phishing, brand impersonation, and credential-based attacks,” Check Point concluded. “This is not because the threats are new, but because the motivation and attention behind them is significantly higher than usual.”