University of Michigan Research Exposes Russian Max App Surveillance

Forensic research led by Roya Ensafi at the University of Michigan has revealed that Max, a Russian super-app developed by VKontakte, possesses extensive surveillance capabilities. The platform integrates messaging, payments, and government services, but researchers found it can screenshot user devices, access mini-app data, and impersonate users without their knowledge.

Researchers warn that the app provides a backdoor into its ecosystem, which the Russian government could potentially use to launch cyberattacks by injecting code into mini-apps. While the Russian state promotes Max as a patriotic alternative to banned services like Telegram and WhatsApp, the government has forced students, teachers, and public-sector employees to install the app to maintain access to education and workplaces.

Despite widespread adoption, some members of the Russian political elite reportedly use second phones for the app to maintain a performative appearance of compliance while continuing to use encrypted services for private communication.