How Russia uses mobile ‘super-app’ Max to spy on its citizens

Over the past 18 months, tens of millions of Russians have been compelled to download a new app called Max on their phones. This violet-blue button, designed for messaging and payments, is touted by authorities as a patriotic alternative to Telegram and WhatsApp. Russian glitterati have even promoted Max in rap videos and comedy routines.

Max, a product of VKontakte, a Russian social media company with ties to the state, is Russia's equivalent of a "super-app." It combines various services into a single platform, including a messaging service to replace Telegram and apps for essential government services. Max is Russia's version of China's WeChat, an all-encompassing platform used by the state to exert social control.

However, unlike WeChat, Max was imposed on citizens who previously had free internet access. Forensic research has now revealed the extent of Max's surveillance capabilities. These capabilities amount to a "backdoor" into its entire mini-app ecosystem on every user's device, according to Roya Ensafi, a computer science professor at the University of Michigan.

Ensafi's research team found that Max can screenshot users' devices and access the contents of its mini-apps without their knowledge. It can impersonate users and inject code into mini-apps, allowing the Russian government to potentially launch cyberattacks. Many Russians in or around state institutions, including schoolteachers, have been forced to use Max by officials. The platform has replaced Telegram and WhatsApp, which are banned in Russia.