New Specula tool uses Outlook for remote code execution in Windows

TrustedSec released Specula, a red-team C2 framework that converts Microsoft Outlook into a command-and-control beacon by setting custom Outlook Home Pages via WebView registry keys (abusing CVE-2017-11774 pathways and registry entries) to serve VBScript/JS that executes arbitrary commands; while the CVE was patched in 2017, the registry-based approach can persist on modern Office builds and has been used historically by APT actors, posing a practical persistence and lateral-movement risk.