Cyber Security News

WhatsApp Testing Guest Calls for People Without a WhatsApp Account

WhatsApp is developing a guest-call feature that would let people without a WhatsApp account join encrypted calls through a web link.

This capability would extend WhatsApp’s existing Call Links feature to include guests, letting invited participants join calls directly from a browser without installing the mobile app or creating an account.

Currently, the feature is still in development and is not available to beta testers or the public. WhatsApp has not announced a release date, supported platforms, browser requirements, or limits on guest-call participation.

Browser-Based Call Access

In the proposed workflow, a WhatsApp user would generate a call link from the app’s Calls tab, choose the call type, and then share the URL with another person. A recipient without WhatsApp could open that link in a browser, access a WhatsApp Web call interface, and request to join as a guest.

According to WABetaInfo, this model is similar to the guest-chat functionality that WhatsApp previously introduced for non-account holders. In guest chats, a person receives a browser link and can join an end-to-end encrypted conversation without registering for the platform.

WhatsApp Web generates a unique session identifier, which is part of the process for creating the encryption key that secures the conversation.

Guest calls are expected to operate on the same principle. Instead of requiring a persistent WhatsApp account, the service will generate a unique identifier for the browser session and use it to establish encryption for the call.

WhatsApp has said call content will remain end-to-end encrypted by default, meaning the platform will not have access to the audio or video exchanged between participants.

A key security feature is the mandatory approval step for every non-account guest. Unlike standard WhatsApp users who may enter a call using an existing link, a guest participant must send a request that the host must manually approve before joining.

WhatsApp is developing guest calls on the web (Source: WABetaInfo)

This approval requirement is crucial because a call link could be forwarded, exposed in a message, or accessed by an unintended recipient. Since a guest does not have a conventional WhatsApp identity linked to the session, the host must decide whether to permit the person requesting entry.

Hosts will also retain controls available in regular calls. They can approve or reject join requests, remove disruptive participants, prevent those removed from rejoining, and end the call for everyone.

These controls will be especially important during business discussions, support calls, classrooms, and other situations where hosts may invite unfamiliar individuals.

While guest calls facilitate communication, they also introduce familiar link-security challenges: possessing the URL may be enough for an unauthorized attempt to join the call.

The mandatory approval process reduces unauthorized participation but does not verify a guest’s real-world identity or prevent impersonation.

Users are therefore advised to share call links through trusted channels, verify a guest’s identity before approving their request, and avoid publicizing links in open posts or groups.

Hosts should also treat unexpected guest requests with caution, particularly if a call involves sensitive business, financial, or personal discussions.

Unlike guest chats, which can remain active for up to 10 days of inactivity, guest calls are intended for real-time communication and will end when the call concludes. This feature could make WhatsApp a more accessible meeting platform while preserving its encryption model, provided users share links carefully and verify participants.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection. 

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Storm-2603 Hackers Exploit SharePoint and Abuse Cloudflare Tunnel to Hide Remote Access

A December intrusion to Storm-2603, the China-based group Microsoft ties to Warlock ransomware. The attackers…

18 seconds ago

OpenSSH sshole Flaw Allows Hackers to Log Into Password-Disabled Linux Accounts Using 257-Character Passwords

A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that…

3 minutes ago

New GhostMap Android Vulnerability Can Crash Phones Permanently Without Opening an App or Granting Permissions

Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can…

13 minutes ago

Microsoft Paint Vulnerability Allows Hackers to Execute Malicious Code Remotely Without User Interaction

Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…

36 minutes ago

ARTEX AI Framework Linked to Bank Breaches and Cloud Attacks Found Exposed Across Hundreds of Servers

An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…

1 hour ago

Shopify Makes IP Allowlisting Mandatory for All Public Apps to Prevent Stolen API Token Abuse

Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…

1 hour ago