Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Inside the 2025 Energy Phishing Wave: Chevron, Conoco, PBF, Phillips 66

hunt.io | blog | #credential-theft | #phishing | #united-states | #energy-sector | #brand-impersonation | #httrack

Summary

Over 1,465 energy-sector phishing detections in a year: Chevron, ConocoPhillips, PBF and Phillips 66 cloned via HTTrack, blending credential theft with investment scams, and missed by most vendors.
Published
Collected

original ↗

Related coverage

blog · hunt.io
ERMAC V3.0 Banking Trojan: Full Source Code Leak and Infrastructure Analysis
Hunt.io obtained the full ERMAC V3.0 source code, exposing critical weaknesses like a hardcoded JWT secret and expanded form injection targeting 700+ financial and crypto apps.
blog · hunt.io
APT36-Linked ClickFix Campaign Spoofs Indian Ministry of Defence, Targets Windows & Linux Users
A ClickFix-style chain spoofs India's Ministry of Defence press-release portal, cloned with HTTrack, and routes Windows and Linux visitors to OS-specific pages that stage malware.
blog · hunt.io
Server-Side Phishing: How Credential Theft Campaigns Are Hiding in Plain Sight
A phishing campaign targeting employee and member portals now validates stolen credentials server-side to hinder analysis; found via HuntSQL crawler data, plus a healthcare-themed page.
blog · hunt.io
GoPhish Infrastructure Targets Polish Energy and Government
An exposed GoPhish admin panel on a Microsoft-hosted IP served domains spoofing Poland's energy regulator and a renewable energy firm, staged for sector-specific credential collection.
blog · hunt.io
GreenSpot APT Targets NetEase 163.com Users with Fake Download Pages & Spoofed Domains
GreenSpot-linked infrastructure spoofs NetEase 163.com with a malicious login page and fake download pages on domains registered hours apart via a reseller, to steal credentials.
blog · hunt.io
Exposing Massive Phishing Scams Abusing Cloudflare Services
One shared Font Awesome kit helped Hunt.io uncover 60,000+ phishing links on Cloudflare Workers and IPFS gateways, mostly fake Microsoft SharePoint/Office365 logins plus DHL and webmail lures.
back