Russian Super-App Max Enables Device Surveillance and Data Harvesting, Security Research Shows

A technical forensic analysis conducted by computer science researchers at the University of Michigan has revealed extensive surveillance capabilities built into Max, Russia's state-promoted multi-purpose mobile application. The software operates as a super-app developed by VKontakte, combining messaging, banking, and public administration tools into a single ecosystem. Researchers found that Max can capture screen contents from user devices without notification, inspect data across integrated mini-apps, and impersonate user identities within its network. The system architecture also permits the injection of executable code into mini-apps, creating pathways for potential cyber operations. Analysis from cybersecurity outlet Anti-Malware.ru and the Telegram channel Scamshot further showed that the application prevents devices from entering sleep mode, tracks notifications, logs installed software, and continuously transmits precise location data to corporate and government servers. The technical evaluation noted that while Max holds broad control over its internal environment, it cannot directly penetrate independent end-to-end encrypted applications like WhatsApp or Telegram.

Associate professor Roya Ensafi, who led the research at the University of Michigan, described the strategic implications of the application's design:

“What Max offers is the most ingenious and at the same time the most frightening tactic used by authoritarian governments to surveil their citizens. Max is a blueprint that any government can follow on the path to digital authoritarianism.”

Mandatory adoption across public life

The rapid expansion of the platform follows extensive administrative pressure from Russian authorities over an 18-month period. Starting in September 2025, Russian regulations required Max to be pre-installed on every new smartphone and tablet sold in the country. Public sector workers, school teachers, and university students have faced strict directives to transfer their daily communication to the service. At several universities, administrators linked physical building and dormitory access directly to digital QR codes generated inside the application. By the summer of 2026, Max had become the most used messaging application in Russia, drawing tens of millions of users who previously had open access to international digital services. Unlike China's WeChat platform, which developed its multi-service integration and state oversight mechanisms over decades, Max was rapidly imposed on an established digital population.

State ties and elite evasion

Max was developed by the VK group, a social media company with close ties to the Kremlin, with reporting indicating that Russian President Vladimir Putin holds an indirect financial stake in the platform. The government supported the rollout with high-profile promotional campaigns, featuring Russian celebrities in comedy skits and rap music videos to frame the service as a patriotic alternative to foreign platforms. Despite state promotion, public trust remains constrained by privacy concerns, prompting divergent behavior between ordinary citizens and political elites. Insiders report that Kremlin officials, diplomats, and senior politicians frequently install Max on dedicated secondary devices to meet compliance requirements while maintaining their substantive private and official communications on other platforms. This forced transition to domestic software coincides with a broader tightening of the Russian information space, including restrictions on foreign messengers, the blocking of hundreds of virtual private networks, and bans on international platforms including YouTube, Instagram, X, and Messenger.