The key words are fraudulently and by disguising as a trustworthy entity. If they clearly identify themselves as oracle, asking about virtualbox usage, then it's not phishing.

> They are literally fishing

You can "fish for info" in a hundred ways. Only a small subset of that is "phishing".