Russia’s Max messaging and payments app can take screenshots, access information in its mini-apps and impersonate users without their knowledge, according to forensic research led by Roya Ensafi, an associate professor of computer science at the University of Michigan.
The findings come as tens of millions of Russians have been pressured or required to install Max, a VKontakte product that combines messaging, payments, banking and government services in one platform.
How the app is being introduced
Authorities have promoted Max as a patriotic alternative to Telegram and WhatsApp. It has also been promoted by Russian entertainers, while the platform’s services have expanded into everyday activities including banking and essential government functions.
Pressure has been reported across state-linked institutions. A Moscow schoolteacher said staff were instructed to move parent chats, homework and other school communication to Max. A university student in St Petersburg said students were told they would be denied access to university buildings or dormitories without a QR code generated through the app. Related coverage: Amnesty says foreign nationals were deceived into fighting for Russia.
What we know now
- Max can access messages and payments held inside its mini-app ecosystem.
- Researchers said the app can inject code into mini-apps, creating a potential route for cyberattacks.
- Telegram and WhatsApp are not accessible through Max if users have those apps installed.
- Max became Russia’s most-used messaging app this summer, while its public news channels remain less developed than Telegram’s.
What the research found
Ensafi’s team downloaded the version of Max used in Russia and examined its surveillance capabilities. Ensafi said the app provides a route into its entire mini-app ecosystem on a user’s device, including the ability to view stored information, messages and payments.
The research does not show that Max can break into Telegram or WhatsApp installed separately on a phone. Both services have been banned in Russia, according to the supplied material, which has increased the pressure on some users to move communications to Max. Read the context: Pavel Durov Faces Terrorism Charges as Russia Targets Telegram Usage.
Use among officials and the public
Several well-connected figures and businesspeople said Max use among Russia’s elite can be largely performative, with Telegram and Signal still used for everyday communication. One person in the Kremlin’s inner circle said some users had bought second phones for Max while keeping their preferred services on their main devices.
Max resembles Telegram in design and functionality, but users interviewed for the report expressed concerns about privacy and surveillance. The platform has not yet replaced Telegram as a major source of news: only a small number of Max public channels have audiences comparable with the largest Telegram channels.
No comments yet. Start the discussion.