An e-mail message within the Wikileaks dump of Democratic National Committee data suggests that the Yahoo account of one DNC staffer may have been specifically targeted by Russian hackers. The leaked message from DNC staffer Alexandra Chalupa includes a photo of a screen displaying a pop-up alert in Yahoo Mail warning, "We strongly suspect that your account has been the target of state-sponsored actors."

"Since I started digging into [Trump campaign chairman Paul] Manafort, these messages have been a daily occurrence on my Yahoo account despite changing my password often," Chalupa reported in the message. Chalupa was looking into Manafort's work in Ukraine, where Manafort managed the campaign of former Ukraine President Viktor F. Yanukovych (who fled to Russia after violent protests against his regime) and worked with pro-Russian and Communist Party politicians forming an opposition block to the current government.

The detail, spotted by cybersecurity researcher Matt Tait and posted to the Twitter account @pwnallthethings, offers another hint at the scope of the campaign to collect intelligence on DNC operations by what appears to be Russia-based "actors" operating on the behalf of Russian intelligence. Earlier evidence collected by SecureWorks detected phishing attacks against the personal Gmail accounts of some DNC staffers as well as attacks on DNC and Clinton campaign e-mail addresses.

The breach of the DNC's network was disclosed in mid-June. It now seems more certain that the attack on the Democratic Congressional Campaign Committee was linked to at least one of the sources of that breach. Further information published today by the security firms Fidelis and ThreatConnect indicates that the subsequent hack of the DCCC was launched the same day that the DNC hack was detected—by actors tied to the "Fancy Bear" group that had been behind part of the DNC breach.

In blog posts from both companies, researchers at Fidelis and ThreatConnect detailed the forensic investigation into the domain used in a hack of the DCCC's website that re-routed clicks by would-be donors to a lookalike site. The domain of the redirect site, registered through a "bulletproof" domain registrar service called I.T. Itch, was a one-letter variation from the domain used by ActBlue, the DNC's contribution processor. The fake e-mail address used for the registrant was the same one used for a number of other domains that were part of earlier attacks by the "Fancy Bear" group, the researchers reported.