WhatsApp is preparing to introduce a new feature enabling users to chat with people who don’t have a WhatsApp account. Currently in development, cybersecurity experts warn this could provide more opportunities for attackers.
Known as ‘Guest Chats’, this feature hasn’t yet entered its beta phase, where a select group tests and provides feedback before public release.
WABetaInfo, a site dedicated to WhatsApp updates, reports that a new Android update in the Google Play Beta Program will likely include the ability for users to chat with non-account holders by sending a link.
Stay informed with the latest updates. Follow KT on WhatsApp Channels.
Challenges in identity concealment
Haider Pasha, Chief Security Officer at Palo Alto Networks EMEA, told Khaleej Times that the feature could pose cybersecurity risks, as it allows attackers to more easily conceal their identities. “Attackers could exploit this anonymity to carry out social engineering attacks or spread harmful links,” he noted. While this feature facilitates communication, and WhatsApp has security measures, Pasha advises users to stay alert.
Without an account, attackers can impersonate others, complicating trust between parties. “Users must exercise caution when connecting with unfamiliar individuals,” he added.
Verified WhatsApp accounts
Conversely, Kaspersky’s Senior Security Consultant, Ahmed Ashraf, highlighted that attackers still need verification by the app. “In guest chats, the sender — a verified WhatsApp account — shares a link. The recipient, the ‘guest,’ doesn’t register but is verified through the link’s channel,” he explained.
Ashraf pointed out that the main uncertainty is what WhatsApp displays in the guest chat window. “If the sender’s info is hidden, the guest can’t verify who’s contacting them. If shown, both parties have some form of verification,” he stated.
He further explained that some attackers may increase their activities with this feature. Since only WhatsApp users can generate and send links, the main risk is from account holders distributing fake links. “Meta retains sender account details, so abusive users can be reported and blocked,” he added.
Enhancing cyber protection
To safeguard against potential threats, Pasha recommends using two-factor authentication, avoiding unknown links, and not sharing personal info. If compromised, reinstalling the app and obtaining a new verification code is advised.
Sharaf suggests limiting profile visibility to contacts only and utilizing reporting and blocking features to deter spammers. He also recommends that WhatsApp should allow users to revoke guest sessions, similar to unlinking devices.
