Research Finds Russia's State-Linked Max App Can Spy on Users' Devices

The work was carried out by a team led by Roya Ensafi, an associate professor of computer science at the University of Michigan, who described the app as amounting to a "backdoor" into its entire mini-app ecosystem on every user's device. "We have studied Russia's escalation of internet control for the past decade," Ensafi said. "What Max provides is the cleverest and also the scariest tactic by authoritarian governments" to surveil their citizens. She called Max "a blueprint any government can follow" toward digital authoritarianism, and said the capabilities it demonstrates are of the kind that governments in Iran, Kazakhstan and India may soon try to build.

Max is a product of VKontakte, the Russian social media company that is deeply entangled with the Russian state. President Vladimir Putin reportedly holds an indirect stake in it. Authorities have presented the app, whose violet-blue button sits on users' phones, as a patriotic alternative to Telegram and WhatsApp, and Russian celebrities have promoted it in rap videos and comic routines. This summer it became the country's most-used messaging app.

The app is Russia's version of a super-app, combining an ecosystem of services in a single platform that hosts mini-apps for banking, messaging intended to replace Telegram, and essential government services. The best-known example internationally is China's WeChat, which facilitates state social controls. WeChat, however, was developed over decades in step with China's other internet controls, whereas Max has been imposed on a population that once had mostly free internet access.

Ensafi's team downloaded the version of the app used in Russia and found that Max can take screenshots of users' devices and of the contents of its mini-apps without their knowledge. It can reach all the information stored in those mini-apps, including messages and payments, and can impersonate users without them knowing. It can also inject code into mini-apps, which Ensafi said would mean the Russian government could use Max to launch cyberattacks. The research adds detail to an ongoing debate about the app's surveillance reach. Crucially, Ensafi said, Max cannot break into Telegram and WhatsApp if users have them installed, but Russia has banned both.

Many Russians working in or around state institutions have in effect been forced onto the platform. Officials and public-sector employees, university students, teachers and schoolchildren have all faced pressure to move their communications to Max. A schoolteacher in Moscow said staff at their school were ordered to switch after instructions from the city authorities. "The school director called us in last March and told us directly: from now on, everything is on Max. That included chats with parents, sending out homework and other school communication," the teacher said. "There isn't really an option to say no, so in the end you just use the app."

Daniil, a university student in St Petersburg, said he reluctantly downloaded Max shortly before the start of the academic year after being told students would be denied access to university buildings or dormitories without a QR code generated through the app. He said he was concerned about security and privacy but felt he had little choice if he wanted to keep using campus facilities.

Among Russia's elite, use of Max often appears largely performative. According to several well-connected figures and prominent businesspeople, Telegram and Signal remain widely used for day-to-day communication. One person in the Kremlin's inner circle said he and several friends had bought second phones solely to install Max while continuing to use their main devices and preferred messaging apps as before. "It's all for show. No one in politics really uses it," the person said, speaking on condition of anonymity.

Max has yet to replace Telegram as a major source of news for Russians. Public channels, which media outlets, bloggers and officials use to broadcast news and commentary to large audiences, remain far less developed on Max, where only a small number have built audiences comparable to the biggest channels on Telegram.

Several Max users contacted by The Guardian said the app closely resembles Telegram in design and functionality, and that concerns about privacy and surveillance are widespread. "Using Max feels like you never quite know who else might be watching," said Nikolai, a 34-year-old consultant in Moscow. He said the app looked modern and slick, but that there was always something slightly sinister about using it.