Phishing Wave Hits U.S. Energy Giants: Chevron, ConocoPhillips Targeted

According to Hunt Intelligence, the U.S. energy sector saw a sharp rise in phishing activity in 2025, with look-alike domains crafted to impersonate major brands such as Chevron, ConocoPhillips, PBF Energy, and Phillips 66. Hunt Intelligence’s data show more than 1,465 phishing detections against the energy sector in the past year, and Chevron alone faced 158 impersonating domains in 2025, up from eight in 2024, highlighting the scale of the campaign.

Attackers mainly use HTTrack-based cloning to replicate corporate websites, then insert fraudulent login or registration forms to harvest credentials and financial data. Examples include chevroncvxstocks[.]com and humanenergy-company.com.cargoxpressdelivery[.]com, both cloned with branding elements like the company slogan and favicon, with some sites masquerading as high-yield investment portals.

The report notes that many domains evade detection, with only 1–9 of 94 security vendors flagging some, underscoring gaps in current defences. Phillips 66 and ConocoPhillips were also heavily targeted, with spoof domains such as conocophillips[.]live and conocophillips[.]com variants, illustrating an industrialised approach to brand abuse and credential harvesting.