|
Getting your Trinity Audio player ready...
|
New forensic research has confirmed what digital rights groups have suspected for months, Russia’s state-backed messaging platform Max functions as a genuine surveillance backdoor, capable of secretly screenshotting users’ devices and monitoring activity across its entire ecosystem of connected mini-apps without users ever knowing it’s happening. The findings come from a research team led by Roya Ensafi, an associate professor of computer science at the University of Michigan, whose group downloaded and forensically examined the actual version of Max distributed inside Russia to map out precisely how the app’s surveillance capabilities function.
Max launched in 2025 through Russian social media giant VK, built as a WeChat-style super-app combining messaging, social media, government service access, a digital ID system, and banking and payments all in one platform. President Vladimir Putin has publicly framed the app as a more secure alternative meeting Russia’s need for what he calls technological sovereignty, part of a broader Kremlin push toward building what internet governance researcher Marielle Wijermars of Maastricht University describes as a sovereign internet, one designed to restructure how Russians access information by migrating them toward platforms the state can more directly control.
The forensic details Ensafi’s team uncovered go considerably further than earlier concerns about Max simply collecting user data. According to their analysis, Max can capture screenshots of a user’s device, including content generated inside third-party mini-apps running within the platform’s ecosystem, entirely without the user’s knowledge or consent. Ensafi described the implications bluntly, saying the app amounts to a backdoor into its entire mini-app ecosystem on every user’s device. Having studied Russia’s escalating internet control efforts for roughly a decade, Ensafi characterized Max as the cleverest and scariest surveillance tactic she’s seen from an authoritarian government, calling it a blueprint any government could follow toward similar digital control, and specifically flagging Iran, Kazakhstan, and India as countries that might attempt something comparable in the future.
Importantly, the research does clarify one meaningful limit to Max’s reach. Ensafi’s team confirmed the app cannot break into or access data within genuinely separate applications like Telegram or WhatsApp that remain outside its own ecosystem, a distinction that matters for understanding exactly where the surveillance risk actually sits. The danger isn’t that Max can hack into unrelated apps on a user’s phone, it’s that anything built as a mini-app within Max’s own platform, and any activity conducted through Max’s messaging and payment functions directly, falls entirely within reach of the super-app’s privileged system access. As cybersecurity researcher Baptiste Robert, CEO of French firm Predicta Lab, put it to AFP, any data passing through the application can reasonably be considered to be in the hands of its owner, and in Max’s case, that owner is ultimately the Russian state.
What makes this surveillance apparatus particularly effective isn’t purely technical, it’s how aggressively the Kremlin has engineered near-total dependency on the app throughout Russian society. Max has been required pre-installed on all new phones and tablets sold in Russia since September 2025. Authorities ordered Russian banks to stop communicating with clients through Telegram and WhatsApp, pushed universities, schools, and public agencies to adopt Max for official communication, and new legislation now requires property managers to reach tenants exclusively through the platform. Large businesses have reportedly pressured employees into downloading the app, schools have shifted all parent communication onto it, and even celebrities and popular bloggers have started migrating their content to Max as the platform’s reach expands. Dmitry Zakharchenko, founder of Russian analytics agency GRFN, has compared the intensity of this promotional campaign to Soviet-era propaganda billboards, an apt comparison given how thoroughly the rollout combines genuine coercion with relentless public messaging.
The app is not officially mandatory, a distinction Russian officials have been careful to maintain, but everyday life in Russia is being engineered to make avoiding it increasingly impractical. Max is also designed to keep functioning during internet disruptions, according to Russia’s Parliamentary Newspaper, a technical feature that makes it considerably harder for citizens to sidestep the platform even during broader connectivity outages that might otherwise limit its reach. That combination of infrastructure-level design and coordinated institutional pressure has driven adoption to genuinely enormous scale, with the service reporting more than 100 million users as of March, a figure that continued climbing as WhatsApp and Telegram access grew increasingly restricted within Russia.
Reaction among ordinary Russians has been mixed, based on accounts gathered by AFP. Yekaterina, a 35-year-old dance teacher, described the app as sufficient for her basic needs, sending messages, photos, and videos. Irina, a 45-year-old doctor, offered a considerably less enthusiastic take, saying she’d been effectively forced to use Max both for her children’s school activities and to access Gosuslugi, the government’s official online services portal where her own patients book medical appointments. She told AFP she planned to buy a separate SIM card specifically so she could download Max on a second phone, keeping it isolated from her primary device rather than granting it access to everything she does digitally.
The security implications extend well beyond Russia’s own borders, according to research from the Digital Forensic Research Lab, which has flagged Max as a genuine cross-border security risk given how the app’s privileged system access and centralized data collection could theoretically expose foreign nationals, businesses, or diplomatic personnel interacting with Russian contacts or services through the platform. Combined with the University of Michigan team’s findings on the app’s mini-app ecosystem backdoor, the research paints a picture of surveillance infrastructure built with genuine technical sophistication, not simply a state messaging app with generous data collection terms buried in its privacy policy, but a platform architecturally designed to grant its operator privileged, largely invisible access across everything built on top of it.
For more coverage of digital surveillance and internet governance, visit Business Tech.
