McAfee ATR details HaoBao, a Lazarus phishing campaign that revived recruiter-themed malicious Word documents to target Bitcoin users and global financial organizations. Victims were prompted to enable macros, after which VBA code decrypted and wrote an implant to the temp directory, launched it with campaign-specific switches such as /haobao, created Startup-folder persistence, and displayed a benign decoy job description. The implants gathered host, user, process, and Bitcoin-Qt registry information before XOR and Base64 encoding the data for HTTP POST communication. Reported infrastructure included worker.co.kr at 210.122.7.129, deltaemis.com, and palgong-cc.co.kr at 221.164.168.185, with Dropbox used to distribute malicious documents. The campaign matters because McAfee observed previously unseen implants and a shift toward cryptocurrency-focused collection alongside Lazarus activity against financial targets.